d57de1823c65c7ad1c272e28984fc89582eb47bfb6c9854173dfd19ee9fd4bd0

Analysis

max time kernel
165s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 08:49

Target

d57de1823c65c7ad1c272e28984fc89582eb47bfb6c9854173dfd19ee9fd4bd0.dll
Size

399KB
MD5

5c541a7bd8e2622d0a9e6246b93d95b2
SHA1

72f9dd8c2491f5f34c29e7235fe75ab9c8504610
SHA256

d57de1823c65c7ad1c272e28984fc89582eb47bfb6c9854173dfd19ee9fd4bd0
SHA512

0c4dadca8f1985f2b8acaed757fc00e93abf5cecadc8f6ad8c290c3fd81ebc07286fbd909d3953c478cd1d9568d65a9f66cedf4b3e62a060051ee3a13105dbdc
SSDEEP

6144:v/57WUNz+xKF1sjcVDNmcCUWHKOW/vNCW3e0dZfFgCZTdsmnElkZKrt21R:v/5CUNyzjc9FW9m1dTdxGmnOkqtu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4932	2540	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 2540	4744	rundll32.exe	81
PID 4744 wrote to memory of 2540	4744	rundll32.exe	81
PID 4744 wrote to memory of 2540	4744	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d57de1823c65c7ad1c272e28984fc89582eb47bfb6c9854173dfd19ee9fd4bd0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d57de1823c65c7ad1c272e28984fc89582eb47bfb6c9854173dfd19ee9fd4bd0.dll,#1
  2⤵
  PID:2540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 688
    3⤵
    - Program crash
    PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2540 -ip 2540
1⤵
PID:4904

memory/2540-133-0x0000000002BA0000-0x0000000002C1F000-memory.dmp

Filesize
508KB

Download
memory/2540-134-0x0000000002C70000-0x0000000002CBB000-memory.dmp

Filesize
300KB

Download
memory/2540-135-0x0000000002BA0000-0x0000000002C1F000-memory.dmp

Filesize
508KB

Download
memory/2540-136-0x0000000002C70000-0x0000000002CBB000-memory.dmp

Filesize
300KB

Download