8c4effb06e6806cee84c4cab0450d28c009de57e0a2e472f2c2e88ba8cc6025e

Analysis

max time kernel
146s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 15:12

Target

8c4effb06e6806cee84c4cab0450d28c009de57e0a2e472f2c2e88ba8cc6025e.dll
Size

233KB
MD5

b8e1afcc738b49a4b2d825cde54524f7
SHA1

867bc405c0a6735d7cf6c0ba2c92e6da26834229
SHA256

8c4effb06e6806cee84c4cab0450d28c009de57e0a2e472f2c2e88ba8cc6025e
SHA512

6d3e3f78b8286f45bd67dbd74f1413e2a19297cfb6816905a98ae01674da9e451a0a50056a2a11644f949963aadf96301b6ca4b82ca95335a942a310b013b876
SSDEEP

6144:0BOsQDQMKs7mJLziELCRu15UNR4fwJ3Lm/OZWYmT3fE:0MhDQCmJLziELCRMUNRlwX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1124	4388	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 4388	620	rundll32.exe	79
PID 620 wrote to memory of 4388	620	rundll32.exe	79
PID 620 wrote to memory of 4388	620	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c4effb06e6806cee84c4cab0450d28c009de57e0a2e472f2c2e88ba8cc6025e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c4effb06e6806cee84c4cab0450d28c009de57e0a2e472f2c2e88ba8cc6025e.dll,#1
  2⤵
  PID:4388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 572
    3⤵
    - Program crash
    PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4388 -ip 4388
1⤵
PID:4796

memory/4388-133-0x0000000010000000-0x0000000010053000-memory.dmp

Filesize
332KB

Download
memory/4388-134-0x00000000015C0000-0x000000000163A000-memory.dmp

Filesize
488KB

Download
memory/4388-135-0x00000000015C0000-0x000000000163A000-memory.dmp

Filesize
488KB

Download