deb920f4466534a2dad9ec332dd4d193f5a029d5c38bb67a288488a7ab7d408b

Analysis

max time kernel
167s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 23:36

Target

deb920f4466534a2dad9ec332dd4d193f5a029d5c38bb67a288488a7ab7d408b.dll
Size

131KB
MD5

360878e59c45ad57c10af93e5cf9715c
SHA1

86f24346f6249101049c7a59a645ff8ab9dea189
SHA256

deb920f4466534a2dad9ec332dd4d193f5a029d5c38bb67a288488a7ab7d408b
SHA512

ad7456ff2cb73fa0d4163991883dd0d59848facf48159342bb0d46060294aba6031eb3a3453049b1408f1fd33e91478d8873d8007bc10c0b0129ff78cd9e1609
SSDEEP

3072:aqUQkfRw82e3jX4qVIFPo5H0Nyeg0a2IjzHtF9j5:L4Rag2FPo5HegR2IjzD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1552	3620	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 3620	2584	rundll32.exe	81
PID 2584 wrote to memory of 3620	2584	rundll32.exe	81
PID 2584 wrote to memory of 3620	2584	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\deb920f4466534a2dad9ec332dd4d193f5a029d5c38bb67a288488a7ab7d408b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\deb920f4466534a2dad9ec332dd4d193f5a029d5c38bb67a288488a7ab7d408b.dll,#1
  2⤵
  PID:3620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 580
    3⤵
    - Program crash
    PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3620 -ip 3620
1⤵
PID:4800

memory/3620-133-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/3620-134-0x0000000002DE0000-0x0000000002F7D000-memory.dmp

Filesize
1.6MB

Download