fb5d21559f68189378dbea998e3a09bd009f67833bf82602dde17a5264d0b213

Analysis

max time kernel
118s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 06:15

Target

fb5d21559f68189378dbea998e3a09bd009f67833bf82602dde17a5264d0b213.dll
Size

88KB
MD5

1681cf0edc59af8f1fe0155e93f679a6
SHA1

504142c58bb45f8aa92f8df7aaeb11dc48e894f8
SHA256

fb5d21559f68189378dbea998e3a09bd009f67833bf82602dde17a5264d0b213
SHA512

2cf7b2dcd54adf3a769389158d1de3c009d27257f58dff4e36f404958343bee97ca5a09f8987a6b84fc6d8a718b8ab4fa89e0d5ea9d7455060a7291b1be9f23e
SSDEEP

1536:glhnOnTffp438lQa55lFrgRtd8s+PslzUr+o+7himGqksTa3Aa55lFLa55lFFGl+:2hnOnTffpeMRlgRtdYUpwZCimGdxOmCD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4860	1512	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 1512	4432	rundll32.exe	81
PID 4432 wrote to memory of 1512	4432	rundll32.exe	81
PID 4432 wrote to memory of 1512	4432	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb5d21559f68189378dbea998e3a09bd009f67833bf82602dde17a5264d0b213.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb5d21559f68189378dbea998e3a09bd009f67833bf82602dde17a5264d0b213.dll,#1
  2⤵
  PID:1512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 580
    3⤵
    - Program crash
    PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1512 -ip 1512
1⤵
PID:4908

memory/1512-133-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download