e632c6468152e1e930d5cec1da9b7a2967605a75b4fbba8aed4308714b17d241

Analysis

max time kernel
92s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 07:24

Target

e632c6468152e1e930d5cec1da9b7a2967605a75b4fbba8aed4308714b17d241.dll
Size

10KB
MD5

6c69165351308f833d642d9216e7c8b0
SHA1

762b03bb1105204fd62177c89e61835378a881ce
SHA256

e632c6468152e1e930d5cec1da9b7a2967605a75b4fbba8aed4308714b17d241
SHA512

5371bc457d525793b578249d736883334b62cb84896b462105f8edd965e59d81e476c864ee664ffe875dace49fbcb0899790169c90ff054b4847e9ae492362ce
SSDEEP

192:Fw8dHabRDEgtHyl0NSypWak6HVdW3yWak8QjdW3w9wv:ndHad/N20IypWak8dWiWak8EdWN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4580	5032	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 5032	4976	rundll32.exe	80
PID 4976 wrote to memory of 5032	4976	rundll32.exe	80
PID 4976 wrote to memory of 5032	4976	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e632c6468152e1e930d5cec1da9b7a2967605a75b4fbba8aed4308714b17d241.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e632c6468152e1e930d5cec1da9b7a2967605a75b4fbba8aed4308714b17d241.dll,#1
  2⤵
  PID:5032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 544
    3⤵
    - Program crash
    PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5032 -ip 5032
1⤵
PID:2208

memory/5032-133-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download
memory/5032-134-0x000000006DD20000-0x000000006DD27000-memory.dmp

Filesize
28KB

Download