2cbdea9561c53b0a639a07c4f7238fe483d6efe2ea97b0d8ae134b36233502f8

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 22:56

Target

2cbdea9561c53b0a639a07c4f7238fe483d6efe2ea97b0d8ae134b36233502f8.dll
Size

59KB
MD5

7c90c95f3b0e181ea4d25d7a35d92d50
SHA1

083ab7650d048e88a47e6ca48773a71cf882528e
SHA256

2cbdea9561c53b0a639a07c4f7238fe483d6efe2ea97b0d8ae134b36233502f8
SHA512

a9de17d693a510707ef3f04f9e9933e3634775c9379a69596df983ba0b95665de405707c27e059269048faef6f36284c39dd9c9aa02c334f10fc1fddabf32f58
SSDEEP

1536:RKdcBXj27/vlxPmgdkNDMA5ZQ9aPHRvyrsoDjO:S2Ts/vlMWkNIkn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5020	4856	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 4856	1600	rundll32.exe	83
PID 1600 wrote to memory of 4856	1600	rundll32.exe	83
PID 1600 wrote to memory of 4856	1600	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cbdea9561c53b0a639a07c4f7238fe483d6efe2ea97b0d8ae134b36233502f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cbdea9561c53b0a639a07c4f7238fe483d6efe2ea97b0d8ae134b36233502f8.dll,#1
  2⤵
  PID:4856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 544
    3⤵
    - Program crash
    PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4856 -ip 4856
1⤵
PID:440

memory/4856-133-0x0000000075650000-0x0000000075667000-memory.dmp

Filesize
92KB

Download