01b1e307bebdbbc4f494de91ea1e19947a057d501b8e8f46d903c97e555d378b

Analysis

max time kernel
144s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 21:12

Target

01b1e307bebdbbc4f494de91ea1e19947a057d501b8e8f46d903c97e555d378b.dll
Size

52KB
MD5

97563553c568371f5e4463e54d3dbb92
SHA1

cddea55358a691898345cd47d28278a3141076b0
SHA256

01b1e307bebdbbc4f494de91ea1e19947a057d501b8e8f46d903c97e555d378b
SHA512

487149039b8bea5e94502fac36250024ce4feb8faece5222a710c00fd068ccdbc53039ea5e6aa7ee6668e513060718c537346e0d7610f1603e12caac954ee823
SSDEEP

768:U0GSzLRUzag7m5dlX/rq94Erj/hhhL0AR1nJyN9uXo9o:U0GShKaFW4m/hhl041n47So+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4888	4148	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 4148	3868	rundll32.exe	78
PID 3868 wrote to memory of 4148	3868	rundll32.exe	78
PID 3868 wrote to memory of 4148	3868	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01b1e307bebdbbc4f494de91ea1e19947a057d501b8e8f46d903c97e555d378b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01b1e307bebdbbc4f494de91ea1e19947a057d501b8e8f46d903c97e555d378b.dll,#1
  2⤵
  PID:4148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 864
    3⤵
    - Program crash
    PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4148 -ip 4148
1⤵
PID:4876

memory/4148-133-0x0000000002C70000-0x0000000002D46000-memory.dmp

Filesize
856KB

Download
memory/4148-134-0x0000000002C70000-0x0000000002D46000-memory.dmp

Filesize
856KB

Download