f3b166c484c622948fc255e0848009829734b30e548aacb2b36e231e893fedd1

Analysis

max time kernel
129s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 12:26

Target
600-57-0x0000000010000000-0x000000001000E000-memory.dll
Size 56KB
Sample221020-pmfedsdfc4
SHA256 f3b166c484c622948fc255e0848009829734b30e548aacb2b36e231e893fedd1
MD5 807798f015fc796141f95bb75f4aff3b
SHA1 d7a312ad2792afd930ebf064e653b3cec48cde3e
SHA512 1938beac40fdd3f8dfada694352daa9adf6101ff86cea59ff32d4fed3c3d5760b8abc420701b8f3e73fbde473467eec31672f9b10c7c6a33cec8c80c09824121
SSDEEP 768:A2gGmsx3R69vhvjyRpq63goMWPXE2bE/JVMq2LATqeeAeOu2D2wqmLiu6:KGBx3R6HApqlaPGhVMq2LpeReOb2Pmp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1460	1656	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 1656	4792	rundll32.exe	79
PID 4792 wrote to memory of 1656	4792	rundll32.exe	79
PID 4792 wrote to memory of 1656	4792	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\600-57-0x0000000010000000-0x000000001000E000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\600-57-0x0000000010000000-0x000000001000E000-memory.dll,#1
  2⤵
  PID:1656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 560
    3⤵
    - Program crash
    PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1656 -ip 1656
1⤵
PID:4908