cb8266b0ca592c5c4218660d7d09e7796f0df92f67afd24112b8ef0d75908191

Analysis

max time kernel
85s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 23:08

Target

cb8266b0ca592c5c4218660d7d09e7796f0df92f67afd24112b8ef0d75908191.dll
Size

48KB
MD5

33f3bacf24d3282e5e79bb07a19bb190
SHA1

840b2068a13821be0793c922264124b934d5c252
SHA256

cb8266b0ca592c5c4218660d7d09e7796f0df92f67afd24112b8ef0d75908191
SHA512

1ecb63e10600700d6a57a4d1f8062ff74e98e3bc04e342962a6a37028bcc5f58c2e9030eebee3bafb42a67c125a3dbb2f0d81c82ba9d49da2a873f79aa560a5e
SSDEEP

768:k839qG4RjGubnP1LaIXR+J8HWUXIs4IX2IB6zz7SjvSyaMXo9zVP:kFG4RSubnP19R+JkXIwXtAzz7Sjvl1of

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4336	4860	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4860	4920	rundll32.exe	81
PID 4920 wrote to memory of 4860	4920	rundll32.exe	81
PID 4920 wrote to memory of 4860	4920	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb8266b0ca592c5c4218660d7d09e7796f0df92f67afd24112b8ef0d75908191.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb8266b0ca592c5c4218660d7d09e7796f0df92f67afd24112b8ef0d75908191.dll,#1
  2⤵
  PID:4860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 816
    3⤵
    - Program crash
    PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4860 -ip 4860
1⤵
PID:3104

memory/4860-133-0x0000000002F40000-0x0000000003016000-memory.dmp

Filesize
856KB

Download
memory/4860-134-0x0000000002F40000-0x0000000003016000-memory.dmp

Filesize
856KB

Download