423935a408fedb83d630b33dfd13d016c6b859283a0787ab52182d0920470cfb

Analysis

max time kernel
96s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 06:39

Target

423935a408fedb83d630b33dfd13d016c6b859283a0787ab52182d0920470cfb.dll
Size

262KB
MD5

26f15a2824afd15200480b413537cc59
SHA1

41de718a49fb6704652ce99563f3981762d1b6d7
SHA256

423935a408fedb83d630b33dfd13d016c6b859283a0787ab52182d0920470cfb
SHA512

9b75bb0eab5d44a72f7a36522cb370a116d6646c06c9c2bb2bacaf6d896653ed1b1156859cf9542181791e5b8cc37d8820a32221ba979a81300e9b9170d7172e
SSDEEP

6144:nzzNq38KFOVb2eJSMoBQOXdymEbHBk1vg:zZq3obNoQejELa1v

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1200	5048	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 5048	5096	rundll32.exe	81
PID 5096 wrote to memory of 5048	5096	rundll32.exe	81
PID 5096 wrote to memory of 5048	5096	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\423935a408fedb83d630b33dfd13d016c6b859283a0787ab52182d0920470cfb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\423935a408fedb83d630b33dfd13d016c6b859283a0787ab52182d0920470cfb.dll,#1
  2⤵
  PID:5048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 588
    3⤵
    - Program crash
    PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5048 -ip 5048
1⤵
PID:3372

memory/5048-133-0x0000000073730000-0x000000007377A000-memory.dmp

Filesize
296KB

Download
memory/5048-134-0x0000000073730000-0x000000007377A000-memory.dmp

Filesize
296KB

Download