a3ca2ad9f3b5e4710e02bb540c25ac97e2e12131fa58bc24643896ffcfa03cbf

Analysis

max time kernel
32s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2022, 22:24

Target

a3ca2ad9f3b5e4710e02bb540c25ac97e2e12131fa58bc24643896ffcfa03cbf.dll
Size

8KB
MD5

992e588503f2940fb982266685f012a5
SHA1

e88712f33d173702828a76a2995815037c93f7bc
SHA256

a3ca2ad9f3b5e4710e02bb540c25ac97e2e12131fa58bc24643896ffcfa03cbf
SHA512

56d7cbf6319eca6863bba718ee5a28f86b5c7465caeddc2de3a5e0482edf6f0b5ad2d2819546d5e502e3de5d147324e6b59cf23aa0720963ef3a350103659392
SSDEEP

96:kNjielgCOqfh3Um47aHpUz2g/y7y0gRcArjg6gdS2ntQ2oo9Er6LkBPsZ7qWu9:kNG8O4h3UlypG1hRe42Lwr6LkBPsZ79s

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4544	1564	WerFault.exe	75

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1564	1152	rundll32.exe	75
PID 1152 wrote to memory of 1564	1152	rundll32.exe	75
PID 1152 wrote to memory of 1564	1152	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3ca2ad9f3b5e4710e02bb540c25ac97e2e12131fa58bc24643896ffcfa03cbf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3ca2ad9f3b5e4710e02bb540c25ac97e2e12131fa58bc24643896ffcfa03cbf.dll,#1
  2⤵
  PID:1564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 568
    3⤵
    - Program crash
    PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1564 -ip 1564
1⤵
PID:3012

memory/1564-133-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download