d3e31dcddd1691d3c5f2aab776d3ba89ae49f7d09e5301f8395fe7a6971a510c

Analysis

max time kernel
177s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 13:26

Target
d3e31dcddd1691d3c5f2aab776d3ba89ae49f7d09e5301f8395fe7a6971a510c.dll
Size 5KB
Sample221003-qpsm6shbd3
SHA256 d3e31dcddd1691d3c5f2aab776d3ba89ae49f7d09e5301f8395fe7a6971a510c
MD5 4c75e42d3e68799faff97e3367a1f1c7
SHA1 1e11943f324ff82ab53bb6306aea2620adbd38aa
SHA512 9f7a47523fa47f445584a5407cd0acc00f49c34dc264b5a81b62fc0a8df27f801db8648c5830784d58c1910ad08b081cb4541435c6b00bb1074b09ea17b6e3d6
SSDEEP 96:68ewz4eYudnYcZUHB5tzhNM0piNvnMh1eR2CXVX2IJkZ:VewzMudnYcyuNvne1GXVX2b
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1180	4364	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4364	4260	rundll32.exe	78
PID 4260 wrote to memory of 4364	4260	rundll32.exe	78
PID 4260 wrote to memory of 4364	4260	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3e31dcddd1691d3c5f2aab776d3ba89ae49f7d09e5301f8395fe7a6971a510c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3e31dcddd1691d3c5f2aab776d3ba89ae49f7d09e5301f8395fe7a6971a510c.dll,#1
  2⤵
  PID:4364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 540
    3⤵
    - Program crash
    PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4364 -ip 4364
1⤵
PID:4352

memory/4364-133-0x0000000025000000-0x0000000025012000-memory.dmp

Download