9aaa72c4af2ad9a36a613f7e1a09f60096b8ad3015a081561ca0dea73901d7da

Analysis

max time kernel
133s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 01:33

Target

9aaa72c4af2ad9a36a613f7e1a09f60096b8ad3015a081561ca0dea73901d7da.dll
Size

256KB
MD5

41fc968609be03deda35bc065c7a620b
SHA1

cb7390338c5fe3a28b8e29cbe7452ee86c639f45
SHA256

9aaa72c4af2ad9a36a613f7e1a09f60096b8ad3015a081561ca0dea73901d7da
SHA512

742d6204eb3e045d49f0677e3ebd7005897a1a59b3b3323191ba0ac77c930e6016f2330aae82bcad49c304955e0aec1a447ab4cb3122232c9a2332829e64128c
SSDEEP

6144:SB149EicyHA27X+2dJZgwvJtw0kbqOIC5oT4QasRO7voWmH8b3T7:SX49zcyz7X+2t00ktF5o5dOjucbD7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3540	5048	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 5048	4168	rundll32.exe	80
PID 4168 wrote to memory of 5048	4168	rundll32.exe	80
PID 4168 wrote to memory of 5048	4168	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9aaa72c4af2ad9a36a613f7e1a09f60096b8ad3015a081561ca0dea73901d7da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9aaa72c4af2ad9a36a613f7e1a09f60096b8ad3015a081561ca0dea73901d7da.dll,#1
  2⤵
  PID:5048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 552
    3⤵
    - Program crash
    PID:3540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5048 -ip 5048
1⤵
PID:4616

memory/5048-133-0x0000000010000000-0x00000000100BB000-memory.dmp

Filesize
748KB

Download
memory/5048-134-0x0000000010000000-0x00000000100BB000-memory.dmp

Filesize
748KB

Download