4e28b07120d50de47e29d5b0db620bed06088cf19c279909084a68e47d288ade

Analysis

max time kernel
112s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 20:18

Target

4e28b07120d50de47e29d5b0db620bed06088cf19c279909084a68e47d288ade.dll
Size

118KB
MD5

966f03ffd06550719a9fa1e5ea44cdbf
SHA1

74a0ee7fdbb6120ccf062e1d61754c7b83a98079
SHA256

4e28b07120d50de47e29d5b0db620bed06088cf19c279909084a68e47d288ade
SHA512

7b04932b3a524e0486bed92306e1636d3240e9b5cce846c5e6feb3b688c9536f884fe5ffd5502b3611885f0fcccea0f77c0826f313c6f1896084a6143f3e055d
SSDEEP

3072:QdngK7aidAEMG3hjHZdri+z6gBSOHZIJ5idPidfmiRDmdZ:Qh77liNAviS5ZUsi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3880	1296	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1296	3044	rundll32.exe	83
PID 3044 wrote to memory of 1296	3044	rundll32.exe	83
PID 3044 wrote to memory of 1296	3044	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e28b07120d50de47e29d5b0db620bed06088cf19c279909084a68e47d288ade.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e28b07120d50de47e29d5b0db620bed06088cf19c279909084a68e47d288ade.dll,#1
  2⤵
  PID:1296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 556
    3⤵
    - Program crash
    PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1296 -ip 1296
1⤵
PID:1208

memory/1296-133-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download