cb9c6c8b1e1e76d6e1ee08dea7e0657eeec7e9f8350fd6c2bf0d0fd73e20266b

Analysis

max time kernel
138s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 02:24

Target

cb9c6c8b1e1e76d6e1ee08dea7e0657eeec7e9f8350fd6c2bf0d0fd73e20266b.dll
Size

9KB
MD5

64d99e9d8a2585eadfe669b011914f0a
SHA1

e252b4f51d7f2b782cbc2a61abad04e4c5017039
SHA256

cb9c6c8b1e1e76d6e1ee08dea7e0657eeec7e9f8350fd6c2bf0d0fd73e20266b
SHA512

6d2ba20400ad995aec477823848e15c93c01d3c16106301154f3b9102f76a6d8ace6a2504fe04a0330d79b1b6c8918ef6a423ad73674226699896603dcdd877c
SSDEEP

96:q1V7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34b:kuwEt8rsTUtPLzKNWSYWF4b

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4656	4668	WerFault.exe	83
760	4668	WerFault.exe	83

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 4668	3064	rundll32.exe	83
PID 3064 wrote to memory of 4668	3064	rundll32.exe	83
PID 3064 wrote to memory of 4668	3064	rundll32.exe	83
PID 4668 wrote to memory of 4656	4668	rundll32.exe	85
PID 4668 wrote to memory of 4656	4668	rundll32.exe	85
PID 4668 wrote to memory of 4656	4668	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb9c6c8b1e1e76d6e1ee08dea7e0657eeec7e9f8350fd6c2bf0d0fd73e20266b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb9c6c8b1e1e76d6e1ee08dea7e0657eeec7e9f8350fd6c2bf0d0fd73e20266b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 624
    3⤵
    - Program crash
    PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 624
    3⤵
    - Program crash
    PID:760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4668 -ip 4668
1⤵
PID:2200

memory/4668-133-0x0000000001381000-0x0000000001383000-memory.dmp

Filesize
8KB

Download
memory/4668-134-0x0000000001381000-0x0000000001383000-memory.dmp

Filesize
8KB

Download
memory/4668-135-0x0000000001380000-0x0000000001387000-memory.dmp

Filesize
28KB

Download