25f698b7917e05910d6211e14c9fccf72cbb15724efb88ba6fe88e9b313add52

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 04:32

Target

25f698b7917e05910d6211e14c9fccf72cbb15724efb88ba6fe88e9b313add52.dll
Size

9KB
MD5

745f410d0d3a50a702a1a385f81599a0
SHA1

400a533e043904faa9aa244a4b7400b607d57645
SHA256

25f698b7917e05910d6211e14c9fccf72cbb15724efb88ba6fe88e9b313add52
SHA512

859d680909a2d3e85fd39cfd1b3912a3031c153d6dabbdfdef33b26343ef867a6a4abd7fbc01dc4b12a8cea2ee6e1f700230c26e6a086ff217d80da24cf25478
SSDEEP

192:qNo5kmXmEEnkITKoUBQIEtNvokhF5hDJtKfnv23qJthDNp0:s1mWEHI2oT7Nh9Dqv6qJtN70

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4936	1112	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 1112	4332	rundll32.exe	81
PID 4332 wrote to memory of 1112	4332	rundll32.exe	81
PID 4332 wrote to memory of 1112	4332	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25f698b7917e05910d6211e14c9fccf72cbb15724efb88ba6fe88e9b313add52.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\25f698b7917e05910d6211e14c9fccf72cbb15724efb88ba6fe88e9b313add52.dll,#1
  2⤵
  PID:1112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 612
    3⤵
    - Program crash
    PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1112 -ip 1112
1⤵
PID:5040

memory/1112-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download