143165892b6b4d001cbf2eb65c8cd2428b913eff7de1b58b4e4d2afd4c6f96c3

Analysis

max time kernel
92s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 02:23

Target

143165892b6b4d001cbf2eb65c8cd2428b913eff7de1b58b4e4d2afd4c6f96c3.dll
Size

360KB
MD5

647a9bb42cf642160a7a831a6aeb5917
SHA1

57dbd38973e4038e3206ef102e3c5cb414cb7d9d
SHA256

143165892b6b4d001cbf2eb65c8cd2428b913eff7de1b58b4e4d2afd4c6f96c3
SHA512

ab2f76a4f7cb39291480409f49a02171967656780ca40034e55b0fbf84afbe35d6cedcf11ad882fb878ef59ba62dcb41972b96970431e46c59d5e44773cf0857
SSDEEP

6144:69icMIyfGYf2g9qyYuPKcUub1hURZLL8C6cr7pZ2W0LPFsDRxwvFa:69HPyfnf2u1PKcXxhUecr7/0fF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1468	4540	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 4540	3068	rundll32.exe	83
PID 3068 wrote to memory of 4540	3068	rundll32.exe	83
PID 3068 wrote to memory of 4540	3068	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\143165892b6b4d001cbf2eb65c8cd2428b913eff7de1b58b4e4d2afd4c6f96c3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\143165892b6b4d001cbf2eb65c8cd2428b913eff7de1b58b4e4d2afd4c6f96c3.dll,#1
  2⤵
  PID:4540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 596
    3⤵
    - Program crash
    PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4540 -ip 4540
1⤵
PID:1652

memory/4540-133-0x0000000073F10000-0x0000000073F6D000-memory.dmp

Filesize
372KB

Download