599749b109f721f36f76b708e8582886b651e3ce0b855b51ebd5e857abeb6171

Analysis

max time kernel
177s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 10:11

Target

599749b109f721f36f76b708e8582886b651e3ce0b855b51ebd5e857abeb6171.dll
Size

280KB
MD5

40c549486b4de232eb7ca4175981ddd6
SHA1

fd7c1f68aa0613b93139d1f0b9e109648412bf4c
SHA256

599749b109f721f36f76b708e8582886b651e3ce0b855b51ebd5e857abeb6171
SHA512

509608dfe313ca7fe24f7fd7270640338ef1138edbac57d7223ae27ab8a72092d330a665081ac0ac92b271ece6a40d710279f7f68e60e9f2177c3543a0011a08
SSDEEP

3072:4ZYU2rPrsfgVml2lwrsryNqDiXDuFPw7QRFwiCrSsTICt/egcnjhpijRphKQJosa:mY1rtwlUusr2qD6DLec1egSgUQJuAI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2872	4820	WerFault.exe	40

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4820	4880	rundll32.exe	40
PID 4880 wrote to memory of 4820	4880	rundll32.exe	40
PID 4880 wrote to memory of 4820	4880	rundll32.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\599749b109f721f36f76b708e8582886b651e3ce0b855b51ebd5e857abeb6171.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\599749b109f721f36f76b708e8582886b651e3ce0b855b51ebd5e857abeb6171.dll,#1
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 692
    3⤵
    - Program crash
    PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4820 -ip 4820
1⤵
PID:4352

memory/4820-133-0x0000000074980000-0x00000000749C9000-memory.dmp

Filesize
292KB

Download
memory/4820-134-0x0000000001FE0000-0x0000000001FEF000-memory.dmp

Filesize
60KB

Download
memory/4820-135-0x0000000001FF0000-0x0000000001FFF000-memory.dmp

Filesize
60KB

Download