ee0d85cc092e42c775c174f337a3470bb070482bb5b3ef00abf714d85d0e3a33

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2022, 07:35

Target
1060-54-0x0000000000030000-0x000000000003D000-memory.dll
Size 52KB
Sample221013-je5fnabch8
SHA256 ee0d85cc092e42c775c174f337a3470bb070482bb5b3ef00abf714d85d0e3a33
MD5 c7c7a20a5f9235ef7742586ae74602e7
SHA1 ea94d005d1af17e82220db2c456a5d7ae1f237c9
SHA512 4c69811908c0413d727f3061811547ebdd84973c417953a02bc5618f44cf8382653e1cb2543743da20e0a102bc3f59f3f7b8dd52a3e069d4d3b63c75a1470747
SSDEEP 768:t810AE+LKbobvT34luMOY0/xvZyqFUfehkgrjVU58MgJXFlkq9k:tM0AE+LKbsc8BoqgeiejVU58MkTR9k
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
816	5092	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 5092	4296	rundll32.exe	81
PID 4296 wrote to memory of 5092	4296	rundll32.exe	81
PID 4296 wrote to memory of 5092	4296	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1060-54-0x0000000000030000-0x000000000003D000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1060-54-0x0000000000030000-0x000000000003D000-memory.dll,#1
  2⤵
  PID:5092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 560
    3⤵
    - Program crash
    PID:816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5092 -ip 5092
1⤵
PID:5044