e68affe2df389dbe5d34234e2e811171058a8783c79e4eac39081c4a8dca33ef

Analysis

max time kernel
165s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 10:55 UTC

Target

e68affe2df389dbe5d34234e2e811171058a8783c79e4eac39081c4a8dca33ef.dll
Size

96KB
MD5

6331c33d0e6cea5505f433bd4fc5f8ac
SHA1

991cf197cecd00757be9826f93432adbacc7b9cf
SHA256

e68affe2df389dbe5d34234e2e811171058a8783c79e4eac39081c4a8dca33ef
SHA512

df4bba7a39871bd05a58d52c4443dafe4b222db6bec6c9acb9b0a0d44e9992f5c6a02f19db92a2d6ad6fd4b0058a5b1af6900042590fcbb4608e5d4dff4434cc
SSDEEP

1536:8gLPzINeF4tk8EwuPV4S7XhMuIbkbrmab8tij2bus8+19KHfqB9ElGf1y:hLPUN0J8EwuPvNx3e6+1Q89ElG9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1376	4708	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 4708	4380	rundll32.exe	81
PID 4380 wrote to memory of 4708	4380	rundll32.exe	81
PID 4380 wrote to memory of 4708	4380	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e68affe2df389dbe5d34234e2e811171058a8783c79e4eac39081c4a8dca33ef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e68affe2df389dbe5d34234e2e811171058a8783c79e4eac39081c4a8dca33ef.dll,#1
  2⤵
  PID:4708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 568
    3⤵
    - Program crash
    PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4708 -ip 4708
1⤵
PID:4696

memory/4708-133-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download