009deb8dfdd8fc14baeaa3aafd691debb7881ab5e4e95a3d61f77e8d9a881fd9

Analysis

max time kernel
62s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2022, 21:39

Target

009deb8dfdd8fc14baeaa3aafd691debb7881ab5e4e95a3d61f77e8d9a881fd9.dll
Size

2.4MB
MD5

27446dec8c32bcf269badd7418790174
SHA1

1e1b04bbe9f21aa7860f077b3d6da4ee46d1277e
SHA256

009deb8dfdd8fc14baeaa3aafd691debb7881ab5e4e95a3d61f77e8d9a881fd9
SHA512

9d2345d93111c0283a939b9fd4f882cc1521ac893c034f0c70b05b4196dc5873d553851bb308790e28cfe6510588d937817db03791d070cbf6998537a8181f49
SSDEEP

49152:vnykDRAN3qCtnv+Cb2DVCx3UWsYZg/F61SC7WTOKVFQtrT41ZFlRkfOHxwBl:qkDRYhtvXb2D83UDfoIAWTTVCYmX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4684	4968	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 4968	2084	rundll32.exe	83
PID 2084 wrote to memory of 4968	2084	rundll32.exe	83
PID 2084 wrote to memory of 4968	2084	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\009deb8dfdd8fc14baeaa3aafd691debb7881ab5e4e95a3d61f77e8d9a881fd9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\009deb8dfdd8fc14baeaa3aafd691debb7881ab5e4e95a3d61f77e8d9a881fd9.dll,#1
  2⤵
  PID:4968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 652
    3⤵
    - Program crash
    PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4968 -ip 4968
1⤵
PID:4792

memory/4968-133-0x0000000076F10000-0x00000000770B3000-memory.dmp

Filesize
1.6MB

Download
memory/4968-134-0x0000000076810000-0x0000000076A25000-memory.dmp

Filesize
2.1MB

Download
memory/4968-136-0x0000000010000000-0x00000000103BA000-memory.dmp

Filesize
3.7MB

Download