bd0155cf88aed8f93dda2af88065cb6df13837c67a9ad2900547f937b610a477

Analysis

max time kernel
144s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 16:06

Target

bd0155cf88aed8f93dda2af88065cb6df13837c67a9ad2900547f937b610a477.dll
Size

171KB
MD5

e59e9a85ba7fe3f48cead1ca0d980e7a
SHA1

c4c341d307830b88348fb519bbebd4c8825d8820
SHA256

bd0155cf88aed8f93dda2af88065cb6df13837c67a9ad2900547f937b610a477
SHA512

0e14ec61f4b25c130419c35cb7b7b937e4b908805868cf643166feca22057eaaca7f25339347456ed50fab24335e0c35092ee23fdbd227ff83bd6816fbb634dc
SSDEEP

3072:8vp4shD1jhlqUpPMMVS4eKuM1fxyqKSsbwl2/sQbvg+1aBPMzJOq:8/hD1hlqUpP1tPt2SzSFboskMzJO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4576	2248	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2248	2640	rundll32.exe	83
PID 2640 wrote to memory of 2248	2640	rundll32.exe	83
PID 2640 wrote to memory of 2248	2640	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd0155cf88aed8f93dda2af88065cb6df13837c67a9ad2900547f937b610a477.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd0155cf88aed8f93dda2af88065cb6df13837c67a9ad2900547f937b610a477.dll,#1
  2⤵
  PID:2248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 564
    3⤵
    - Program crash
    PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2248 -ip 2248
1⤵
PID:1032

memory/2248-132-0x0000000000000000-mapping.dmp

Download
memory/2248-133-0x0000000002450000-0x0000000002461000-memory.dmp

Filesize
68KB

Download