325e67685a94b8a08984de6690c15d244aa72c3b8121096062f10210218779b8

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2022, 23:05

Target

325e67685a94b8a08984de6690c15d244aa72c3b8121096062f10210218779b8.dll
Size

213KB
MD5

8851e5711eec24b5668052dafca8096f
SHA1

c40588eae5581d1e92006a7a13165c2b52045402
SHA256

325e67685a94b8a08984de6690c15d244aa72c3b8121096062f10210218779b8
SHA512

2a4270ba95931a718fddd742a74f9fb874d057a7f711303be1cfdb29e3ee873fb7c922014d78ac2fc73f340da7732c53955171fceba274fe75739d921dc41b24
SSDEEP

3072:3Hb2xL5szIQnP3Y1YckPesCwOL3eUA8dvSZ:Xi9AjPo7kmKi3eX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3332	4712	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 4712	4532	rundll32.exe	81
PID 4532 wrote to memory of 4712	4532	rundll32.exe	81
PID 4532 wrote to memory of 4712	4532	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\325e67685a94b8a08984de6690c15d244aa72c3b8121096062f10210218779b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\325e67685a94b8a08984de6690c15d244aa72c3b8121096062f10210218779b8.dll,#1
  2⤵
  PID:4712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 544
    3⤵
    - Program crash
    PID:3332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4712 -ip 4712
1⤵
PID:4444

memory/4712-133-0x0000000010000000-0x0000000010039000-memory.dmp

Filesize
228KB

Download