bdaaa36570ccd21c70d15a355484e4429fc77ea39edec62947a5da8a6bf0b27b

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 09:27

Target

bdaaa36570ccd21c70d15a355484e4429fc77ea39edec62947a5da8a6bf0b27b.dll
Size

111KB
MD5

178e7887eefaec27a588eac5a10bdbde
SHA1

db39955fde683f81077195cd984bc15282df5691
SHA256

bdaaa36570ccd21c70d15a355484e4429fc77ea39edec62947a5da8a6bf0b27b
SHA512

c49e85d9068a71725a9601d593c1b68e5b274837b32c4bfd0e0593447bf671e24d94492a2e53c7d379bb7f49f1c1bd1d1095c4cbcc4f6359ccdabe59cc82cd55
SSDEEP

3072:7CpATw+0P+FNR0LUGUwzNVTeOgfom8M3IvjO:2pATlF3TMz2Ogfomz0O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2112	1892	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 1892	1136	rundll32.exe	80
PID 1136 wrote to memory of 1892	1136	rundll32.exe	80
PID 1136 wrote to memory of 1892	1136	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdaaa36570ccd21c70d15a355484e4429fc77ea39edec62947a5da8a6bf0b27b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdaaa36570ccd21c70d15a355484e4429fc77ea39edec62947a5da8a6bf0b27b.dll,#1
  2⤵
  PID:1892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 568
    3⤵
    - Program crash
    PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1892 -ip 1892
1⤵
PID:4940

memory/1892-133-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download