95421ab7a890b69a6317eef0265cb550b0ef738b7f85c71e8b9b0ec3fc7814a3

Analysis

max time kernel
99s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 23:59

Target

95421ab7a890b69a6317eef0265cb550b0ef738b7f85c71e8b9b0ec3fc7814a3.dll
Size

88KB
MD5

04b0d43b4c8545bc80a9cb24d2edbbc0
SHA1

7ac8b20b9a6653f91de7522d43acec592d005236
SHA256

95421ab7a890b69a6317eef0265cb550b0ef738b7f85c71e8b9b0ec3fc7814a3
SHA512

5e58c9b7dae6e6470685743b2e9e2eb972192ad78689b2705edbad29276ffacd9f96f33f6d4d1ccf0d7e5e9a92b815e140522a0fcf355c8178f6a8b270cf63c4
SSDEEP

1536:xBImWaE4GieRSHth1JVWhZqEOtIPfx9kF3E+nGC3EwFYg:bWVsHt3OhZqxqfN60Jg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3012	3188	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 3188	3404	rundll32.exe	82
PID 3404 wrote to memory of 3188	3404	rundll32.exe	82
PID 3404 wrote to memory of 3188	3404	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95421ab7a890b69a6317eef0265cb550b0ef738b7f85c71e8b9b0ec3fc7814a3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\95421ab7a890b69a6317eef0265cb550b0ef738b7f85c71e8b9b0ec3fc7814a3.dll,#1
  2⤵
  PID:3188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 560
    3⤵
    - Program crash
    PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3188 -ip 3188
1⤵
PID:5024

memory/3188-133-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download