b2d80f00da546429b0ec0b9a9c129d4ce022c98f05c7fe3164f02832389158c0

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 17:01

Target

b2d80f00da546429b0ec0b9a9c129d4ce022c98f05c7fe3164f02832389158c0.dll
Size

354KB
MD5

0df4adb7a2ace2773400bc9fa1d35018
SHA1

185d686700c87792ed5d37faeb53a24aed6c6ac6
SHA256

b2d80f00da546429b0ec0b9a9c129d4ce022c98f05c7fe3164f02832389158c0
SHA512

4d3a95029998a6a4df263e84ba466ced2da971101eee932229c97820d8fbcdedbea55c842728776f7773ead8f6ef538466651ed3c78b37029d6e22693af512ac
SSDEEP

6144:diCNfGD5A7mysR2UChHfg8G6v+WoT4TEgy/vM/kCoeJ:dlN+D9J1U/NGSZMMs6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4316	1108	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 1108	3640	rundll32.exe	80
PID 3640 wrote to memory of 1108	3640	rundll32.exe	80
PID 3640 wrote to memory of 1108	3640	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2d80f00da546429b0ec0b9a9c129d4ce022c98f05c7fe3164f02832389158c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2d80f00da546429b0ec0b9a9c129d4ce022c98f05c7fe3164f02832389158c0.dll,#1
  2⤵
  PID:1108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 540
    3⤵
    - Program crash
    PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1108 -ip 1108
1⤵
PID:2412

memory/1108-133-0x0000000001FF0000-0x00000000023C1000-memory.dmp

Filesize
3.8MB

Download
memory/1108-134-0x0000000001FF0000-0x00000000023C1000-memory.dmp

Filesize
3.8MB

Download