c9788f09cda95960f338dfd1a5cf677a59549a088640f1c909e360961f6e0ec7

Analysis

max time kernel
175s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 01:19

Target

c9788f09cda95960f338dfd1a5cf677a59549a088640f1c909e360961f6e0ec7.dll
Size

80KB
MD5

68c980362a27b44d34a11c57835cfd30
SHA1

ec90cd14332b6e87fd23c7fdc1e3fe1902b6fa5c
SHA256

c9788f09cda95960f338dfd1a5cf677a59549a088640f1c909e360961f6e0ec7
SHA512

e663595377f528e3f239680135f12b120142cb8141210b8f46866b2d6edd9cc0f9d6fdfcf043eb6e0fcacf111db06b86c68e2e922e724d4a40e850fb7c710d9b
SSDEEP

768:+K9/lxL3inlX43pw4lZSJN6BRdZ2NHB9UKP+C4NoBQfdHvNkk:flxrYlI3p9grW5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4336	2828	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 2828	4352	rundll32.exe	80
PID 4352 wrote to memory of 2828	4352	rundll32.exe	80
PID 4352 wrote to memory of 2828	4352	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9788f09cda95960f338dfd1a5cf677a59549a088640f1c909e360961f6e0ec7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9788f09cda95960f338dfd1a5cf677a59549a088640f1c909e360961f6e0ec7.dll,#1
  2⤵
  PID:2828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 656
    3⤵
    - Program crash
    PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2828 -ip 2828
1⤵
PID:1940

memory/2828-133-0x0000000020000000-0x000000002001A000-memory.dmp

Filesize
104KB

Download