9e6eef5154de943331f0f6ad4acff7036e574ef2c4994b967949c3215abf579f

Analysis

max time kernel
112s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 23:46

Target

9e6eef5154de943331f0f6ad4acff7036e574ef2c4994b967949c3215abf579f.dll
Size

120KB
MD5

6f0f9156a0bc0db4e36ed71de2f99460
SHA1

0ca090c4e2697560950e332b13560ec2df90d178
SHA256

9e6eef5154de943331f0f6ad4acff7036e574ef2c4994b967949c3215abf579f
SHA512

aecddc19235aab9cf457a1cf5c60b3e9edb6c96244af31b7b737fa74031e4ab725a43383cae1e9197b5143df4bb1568e28f0941b045f578539ef3a79a6b6a562
SSDEEP

3072:A8bwVuPTwfXPWttQIQ+kJYVISDLgv+q+67CU+v+dESyW:ByuKXPWttQIQ+kYPgmZwdh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4816	1016	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1016	1792	rundll32.exe	81
PID 1792 wrote to memory of 1016	1792	rundll32.exe	81
PID 1792 wrote to memory of 1016	1792	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e6eef5154de943331f0f6ad4acff7036e574ef2c4994b967949c3215abf579f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e6eef5154de943331f0f6ad4acff7036e574ef2c4994b967949c3215abf579f.dll,#1
  2⤵
  PID:1016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 560
    3⤵
    - Program crash
    PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1016 -ip 1016
1⤵
PID:3752

memory/1016-133-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download