394dfd45eedad9a236bf0f708fd7e979c5a8a3e95004564534a44c96fb1aa690

Analysis

max time kernel
91s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 17:53

Target

394dfd45eedad9a236bf0f708fd7e979c5a8a3e95004564534a44c96fb1aa690.dll
Size

560KB
MD5

467235e8cb50b126c746d66b8572a7d0
SHA1

5c5897278937523d7ee234241afaee4178ba308d
SHA256

394dfd45eedad9a236bf0f708fd7e979c5a8a3e95004564534a44c96fb1aa690
SHA512

ea34c73be4b4ce12359bbda96bb99da25764dfb7bce6431fbf3be420788cd6f1ccc13a8db8103923bb58799a840e0d9c08af7b6af1a11bba131a19b46f2421a2
SSDEEP

12288:V1RF50CI64dtJlNI9a2faFPa/HnqtGoXUh4t7YD8OHm5sh:V1p2tJ89Ta1SHmGAUh4t0D8OGg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1300	1120	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 1120	928	rundll32.exe	80
PID 928 wrote to memory of 1120	928	rundll32.exe	80
PID 928 wrote to memory of 1120	928	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\394dfd45eedad9a236bf0f708fd7e979c5a8a3e95004564534a44c96fb1aa690.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\394dfd45eedad9a236bf0f708fd7e979c5a8a3e95004564534a44c96fb1aa690.dll,#1
  2⤵
  PID:1120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 576
    3⤵
    - Program crash
    PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1120 -ip 1120
1⤵
PID:4900

memory/1120-133-0x0000000010000000-0x00000000100A8000-memory.dmp

Filesize
672KB

Download