e13c6922dee27701c9655aff42023dba10c8ad0f90bd82939b176d500a6aac25

Analysis

max time kernel
179s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 07:24

Target

e13c6922dee27701c9655aff42023dba10c8ad0f90bd82939b176d500a6aac25.dll
Size

9KB
MD5

45c81e829685d8056dabf336dae59ffe
SHA1

9946ea6277b47fdbe4fff7764b931703916bfc55
SHA256

e13c6922dee27701c9655aff42023dba10c8ad0f90bd82939b176d500a6aac25
SHA512

42a272b2506bf0b785ab9cdba4f1eb7b93aca0dbd6409fe48c90b3ab196e78c5c3d7b81f40dd3e37e31ee7f7406f86a7943c2273f715fdac2d9e8efbd55d50aa
SSDEEP

96:qJV7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34bE:wuwEt8rsTUtPLzKNWSYWF4bE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
532	4896	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4896	4864	rundll32.exe	82
PID 4864 wrote to memory of 4896	4864	rundll32.exe	82
PID 4864 wrote to memory of 4896	4864	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e13c6922dee27701c9655aff42023dba10c8ad0f90bd82939b176d500a6aac25.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e13c6922dee27701c9655aff42023dba10c8ad0f90bd82939b176d500a6aac25.dll,#1
  2⤵
  PID:4896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 624
    3⤵
    - Program crash
    PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4896 -ip 4896
1⤵
PID:4204

memory/4896-133-0x0000000002661000-0x0000000002663000-memory.dmp

Filesize
8KB

Download
memory/4896-134-0x0000000002661000-0x0000000002663000-memory.dmp

Filesize
8KB

Download
memory/4896-135-0x0000000002660000-0x0000000002667000-memory.dmp

Filesize
28KB

Download