67979f0a6f3a998ee9acc05771126bf7edd4f9249873f99660700ba018ede448

Analysis

max time kernel
152s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 21:12

Target

67979f0a6f3a998ee9acc05771126bf7edd4f9249873f99660700ba018ede448.dll
Size

42KB
MD5

b44052d3577512a8b6c6301958b3a58c
SHA1

eb5a3d5e398a99239c9177aa3e0410493b4dea5a
SHA256

67979f0a6f3a998ee9acc05771126bf7edd4f9249873f99660700ba018ede448
SHA512

2201b4aa3eb179a9f9282d9ae95044c78c746ba0ae743f1719596257f22ee6fc895dc90ba2ce459ca7104c7a9780ebf7a7c8af11c716c7bd4aa9967a372f4a6a
SSDEEP

768:B0cz/iE+YFLZ1QoTgxdu7ZIUInoEv4zrNffXGU2k1/+SJOydXm1o9Iv:HCYP2oPyUrEvAJ9V1/+6h2o2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	1912	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 1912	4948	rundll32.exe	79
PID 4948 wrote to memory of 1912	4948	rundll32.exe	79
PID 4948 wrote to memory of 1912	4948	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67979f0a6f3a998ee9acc05771126bf7edd4f9249873f99660700ba018ede448.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\67979f0a6f3a998ee9acc05771126bf7edd4f9249873f99660700ba018ede448.dll,#1
  2⤵
  PID:1912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 844
    3⤵
    - Program crash
    PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1912 -ip 1912
1⤵
PID:1028

memory/1912-133-0x0000000003020000-0x00000000030F6000-memory.dmp

Filesize
856KB

Download
memory/1912-134-0x0000000003020000-0x00000000030F6000-memory.dmp

Filesize
856KB

Download