d44efea59d6fef0c31df4ad1a32236e44c012b8a86f29e6570100d3aca8475d6

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 16:40

Target

d44efea59d6fef0c31df4ad1a32236e44c012b8a86f29e6570100d3aca8475d6.dll
Size

9KB
MD5

a073b191384f395ed9f2355e024ad840
SHA1

85366bf51cc7e1765037c0715cf547ce61c77030
SHA256

d44efea59d6fef0c31df4ad1a32236e44c012b8a86f29e6570100d3aca8475d6
SHA512

eeba1685dc2b8fcd9f773620d8bddc8afcafe2a67586202f69c72b48be5c90d8a7588f0b2beacce6b131baf300805ab7ddd6765b8c4b4fb79f51a0f109850dde
SSDEEP

192:zNo5kmXmEEnkITKoUBQIEtNvokhF5hDJtKfnv23qJthDNp0:h1mWEHI2oT7Nh9Dqv6qJtN70

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
396	4648	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4648	4644	rundll32.exe	82
PID 4644 wrote to memory of 4648	4644	rundll32.exe	82
PID 4644 wrote to memory of 4648	4644	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d44efea59d6fef0c31df4ad1a32236e44c012b8a86f29e6570100d3aca8475d6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d44efea59d6fef0c31df4ad1a32236e44c012b8a86f29e6570100d3aca8475d6.dll,#1
  2⤵
  PID:4648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 612
    3⤵
    - Program crash
    PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4648 -ip 4648
1⤵
PID:388

memory/4648-136-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download