799a95c927567179cefcb8c2047166dbaf0839467a03219fd1f511c95c566be1

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 09:33

Target

799a95c927567179cefcb8c2047166dbaf0839467a03219fd1f511c95c566be1.dll
Size

68KB
MD5

3c1d42c9c7b3e74ab80acf8900ff52fc
SHA1

40a893ad64c3a38ae628c22dd39b4c126755404d
SHA256

799a95c927567179cefcb8c2047166dbaf0839467a03219fd1f511c95c566be1
SHA512

4c103c4832463c4c124bd8c08026e7ec22df11e9fdb5ccba8695fd2e7fc52a6063c34d524570d660cfed9a8117be0fce287273342d19d2ce05e532453f2fbf75
SSDEEP

1536:JpcvBq2h8vAVzvIqBJvqCE4XngW+KMu0fZ5Enn2D6pWft:Jp+hLuqB9E43lhMfcn2D6E

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2688	1952	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 1952	3600	rundll32.exe	82
PID 3600 wrote to memory of 1952	3600	rundll32.exe	82
PID 3600 wrote to memory of 1952	3600	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\799a95c927567179cefcb8c2047166dbaf0839467a03219fd1f511c95c566be1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\799a95c927567179cefcb8c2047166dbaf0839467a03219fd1f511c95c566be1.dll,#1
  2⤵
  PID:1952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 544
    3⤵
    - Program crash
    PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1952 -ip 1952
1⤵
PID:2540

memory/1952-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download