2118fc70340f979f1404fc4a6c6a27f11675b35ab63b84b3528ebaf6316fb90e

Analysis

max time kernel
136s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 20:07

Target

2118fc70340f979f1404fc4a6c6a27f11675b35ab63b84b3528ebaf6316fb90e.dll
Size

172KB
MD5

64cf5cdca9ac1bbfe431dcfa7e4737a0
SHA1

2ad58eee9227705739fc8cfb04025b52343c0426
SHA256

2118fc70340f979f1404fc4a6c6a27f11675b35ab63b84b3528ebaf6316fb90e
SHA512

eeee0aadd31a67516f42fc757818019cdcaeaabeb864496b1965b21b0cc5a3c2533420b732ce6561658c149ae89089b4aecfebddffbc93efa1c184b7235e73e9
SSDEEP

3072:TsJktXqkaAp78heywCtFUulBvDnS8gLrbPzNgjz6onXZWP69Dat2:FtXqkaa4hzwS5gtloJWi9Dat2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4672	1664	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1664	3064	rundll32.exe	82
PID 3064 wrote to memory of 1664	3064	rundll32.exe	82
PID 3064 wrote to memory of 1664	3064	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2118fc70340f979f1404fc4a6c6a27f11675b35ab63b84b3528ebaf6316fb90e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2118fc70340f979f1404fc4a6c6a27f11675b35ab63b84b3528ebaf6316fb90e.dll,#1
  2⤵
  PID:1664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 600
    3⤵
    - Program crash
    PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1664 -ip 1664
1⤵
PID:2304

memory/1664-133-0x000000006D0C0000-0x000000006D0EB000-memory.dmp

Filesize
172KB

Download