ce042a07d6f3907e468295e401968435e8d2315f3c913f215e4994e64cc0844f

Analysis

max time kernel
153s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 12:14

Target

ce042a07d6f3907e468295e401968435e8d2315f3c913f215e4994e64cc0844f.dll
Size

63KB
MD5

67f60fe2486fc92633e598a9af1a9b55
SHA1

c6fafdad7f47017440cd473d2c3edcbb29adcc3b
SHA256

ce042a07d6f3907e468295e401968435e8d2315f3c913f215e4994e64cc0844f
SHA512

792362a65388c568214ef9a02f54c25fc4f26869882bb6b1b1e995a36cd9399493dfaada8575c12897d613749bf2cb7ab2c175709681c6d71405aea672b414ad
SSDEEP

1536:aqcSpyjkghgeQc4dq6H3pZw59kpNRSm1OAyFGwLQBamGe:aqzXiQldqa3TqKXOAyFswm/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	1256	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1256	1616	rundll32.exe	81
PID 1616 wrote to memory of 1256	1616	rundll32.exe	81
PID 1616 wrote to memory of 1256	1616	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce042a07d6f3907e468295e401968435e8d2315f3c913f215e4994e64cc0844f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce042a07d6f3907e468295e401968435e8d2315f3c913f215e4994e64cc0844f.dll,#1
  2⤵
  PID:1256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 656
    3⤵
    - Program crash
    PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1256 -ip 1256
1⤵
PID:4196

memory/1256-133-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download