c3eea375094ec97724fa5b9f23d98e2a556bbfca5f171b503dcc3ca0ec3cbd2b

Analysis

max time kernel
138s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 09:33

Target

c3eea375094ec97724fa5b9f23d98e2a556bbfca5f171b503dcc3ca0ec3cbd2b.dll
Size

73KB
MD5

65557098f64882159cd0f94e604d1ed3
SHA1

2df4eb91585461e9a615e5369c2a0d8a7924ed50
SHA256

c3eea375094ec97724fa5b9f23d98e2a556bbfca5f171b503dcc3ca0ec3cbd2b
SHA512

0b484005aa6b67844c62c1dc55e46e8eb615fc85ab9467b99f40c198d4d66c147d749bcc2220b068c5fb0845ebf6f3c3f4175871f9b7009cf5dd72211ce22018
SSDEEP

1536:Zwoq+LsVXPhfuJU5BfGFCl/J3JlmVwU4x0ruXhlpLJ1n7bSuz:ON+oVXZGJU5pl/JZlMwU4+yd97uW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2440	4704	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4704	4964	rundll32.exe	82
PID 4964 wrote to memory of 4704	4964	rundll32.exe	82
PID 4964 wrote to memory of 4704	4964	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3eea375094ec97724fa5b9f23d98e2a556bbfca5f171b503dcc3ca0ec3cbd2b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3eea375094ec97724fa5b9f23d98e2a556bbfca5f171b503dcc3ca0ec3cbd2b.dll,#1
  2⤵
  PID:4704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 544
    3⤵
    - Program crash
    PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4704 -ip 4704
1⤵
PID:4324

memory/4704-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download