d3c2b666190656df9596c8cac83c0a12ada082b2e521ed708dcda1e40bcbbb4e

Analysis

max time kernel
134s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2022, 16:12

Target

332-98-0x0000000000260000-0x0000000000289000-memory.dll
Size

164KB
MD5

7292bb90f0ea8d8d4cdf47c553f7d701
SHA1

4df9f498ea583dec85f0698e9532031d35369ef1
SHA256

d3c2b666190656df9596c8cac83c0a12ada082b2e521ed708dcda1e40bcbbb4e
SHA512

5a3c9e1843425182c6fe61f1721901aa00279f623377f4af73aa69629f6ad0660d2501a36244e5edec5fbd868b22189f209f24ebc2e6183b3cd6775ef19761a5
SSDEEP

3072:B5mdm9v/xM0/f6QvANJIeH34TBf97/6oPO/ya:v9vJM0/bYNJFH34TBV7/vW/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3536	1800	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 1800	3852	rundll32.exe	81
PID 3852 wrote to memory of 1800	3852	rundll32.exe	81
PID 3852 wrote to memory of 1800	3852	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\332-98-0x0000000000260000-0x0000000000289000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\332-98-0x0000000000260000-0x0000000000289000-memory.dll,#1
  2⤵
  PID:1800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 560
    3⤵
    - Program crash
    PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1800 -ip 1800
1⤵
PID:1780