187b4e443b777815b4271e4194529deedd05f773cd671591273443621ae363d5

Analysis

max time kernel
148s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 07:21

Target

187b4e443b777815b4271e4194529deedd05f773cd671591273443621ae363d5.dll
Size

261KB
MD5

03818ba1608f208ecad3989fc577100d
SHA1

bbe8f775f4e82ed99598bb34c2fccac457c5585e
SHA256

187b4e443b777815b4271e4194529deedd05f773cd671591273443621ae363d5
SHA512

34476f260fc8d303c80c2ea6ee8520b9867f19db459921e07a4b1f1c9a8347f9d9223178b771ab8e540dc6794ea9efbfab68750bbd8a53c341e7f0997e8d5a1e
SSDEEP

6144:HNzQqwxoi3MKu2K92AkNxO9SdjtbRZBu1vg:tkqOTPjxxbjtdZs1v

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4524	4956	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4956	5044	rundll32.exe	83
PID 5044 wrote to memory of 4956	5044	rundll32.exe	83
PID 5044 wrote to memory of 4956	5044	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\187b4e443b777815b4271e4194529deedd05f773cd671591273443621ae363d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\187b4e443b777815b4271e4194529deedd05f773cd671591273443621ae363d5.dll,#1
  2⤵
  PID:4956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 548
    3⤵
    - Program crash
    PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4956 -ip 4956
1⤵
PID:2816

memory/4956-133-0x0000000073760000-0x00000000737AA000-memory.dmp

Filesize
296KB

Download