ff084a610d5595988a38e6ae26a28a977396ac8ce9d528195311db6861fa0f74

Analysis

max time kernel
169s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 21:28

Target

1748-58-0x0000000075210000-0x0000000075303000-memory.dll
Size

972KB
MD5

c70800a83b069ea5444593148667c061
SHA1

5c522f78466b2b36380333df9a4305eb7bd2c19c
SHA256

ff084a610d5595988a38e6ae26a28a977396ac8ce9d528195311db6861fa0f74
SHA512

d19d37efa7a89bcb5a7b447d968beadaf704bbee1f92377399f63eb780ce56e22a66fa767b4d2cbd00aa02af4f870edc9df21bd64643afb5424f3b0748cb2916
SSDEEP

24576:4dabTOPeogLtdk25qMKvb/o2ggJcW2QRqV:MKToeLDk251KvjjXJciqV

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4884 400 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4884	400	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1624 wrote to memory of 400	1624	rundll32.exe	rundll32.exe
PID 1624 wrote to memory of 400	1624	rundll32.exe	rundll32.exe
PID 1624 wrote to memory of 400	1624	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1748-58-0x0000000075210000-0x0000000075303000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1748-58-0x0000000075210000-0x0000000075303000-memory.dll,#1
2⤵
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 560
3⤵
- Program crash
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 400 -ip 400
1⤵
PID:4244