c1b5982b187815fd527ca1979c1331e03364fff0f378526f96d05a89fa96c276

Analysis

max time kernel
140s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 14:21

Target

c1b5982b187815fd527ca1979c1331e03364fff0f378526f96d05a89fa96c276.dll
Size

172KB
MD5

b1fc70611c98f26606959dd79d18a2eb
SHA1

b4c4815f6d9d8b54056295226fe129f3fb57d65c
SHA256

c1b5982b187815fd527ca1979c1331e03364fff0f378526f96d05a89fa96c276
SHA512

093a13f950278dc9325e5ecf04da86dac1dcb6a846e84620379f886b68c6204a0fdbea0520f6639261d2010f9b25b2c53a8c5221d088ba64abccb5a4484a0a7b
SSDEEP

3072:vBtP5zoRKmVu2M/93U1g7KM8iNP0KGZJL5VToqFIWpNq1VaFd4jw6K5zBOOED:vrRzVmVu1ia7KMDZGZVNFA1VaH4jw6K0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4328	4768	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4768	2220	rundll32.exe	81
PID 2220 wrote to memory of 4768	2220	rundll32.exe	81
PID 2220 wrote to memory of 4768	2220	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1b5982b187815fd527ca1979c1331e03364fff0f378526f96d05a89fa96c276.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1b5982b187815fd527ca1979c1331e03364fff0f378526f96d05a89fa96c276.dll,#1
  2⤵
  PID:4768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 604
    3⤵
    - Program crash
    PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4768 -ip 4768
1⤵
PID:4696

memory/4768-132-0x0000000000000000-mapping.dmp

Download
memory/4768-133-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download