d3aff427532405c5183665ff5460a2c448730aae6d2b595831f73073afc4a2cd

Analysis

max time kernel
176s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 22:09

Target

d3aff427532405c5183665ff5460a2c448730aae6d2b595831f73073afc4a2cd.dll
Size

40KB
MD5

836ba9cdcaa1360bf0518f2c5718789c
SHA1

c4d8500c5684cac2a49da10b6a54cada7268c618
SHA256

d3aff427532405c5183665ff5460a2c448730aae6d2b595831f73073afc4a2cd
SHA512

532d15a9ff7e1451822894042ec91887327a4e62b9ff50543be1f5d93c5a1b4fbd5932da3b3d3731989b377c09a314d28ec0ac4ad6b3e830a227b4a5eae65068
SSDEEP

768:W7UIfX493uKFWPjFOUjeuB1l+mNaxXbPq2I99VIo1xgF2stXBdS:OtItuKFWPjFBeuHELXbfHo1xKfJfS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5072	5064	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 5064	3008	rundll32.exe	78
PID 3008 wrote to memory of 5064	3008	rundll32.exe	78
PID 3008 wrote to memory of 5064	3008	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3aff427532405c5183665ff5460a2c448730aae6d2b595831f73073afc4a2cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3aff427532405c5183665ff5460a2c448730aae6d2b595831f73073afc4a2cd.dll,#1
  2⤵
  PID:5064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 560
    3⤵
    - Program crash
    PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5064 -ip 5064
1⤵
PID:4924

memory/5064-133-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download