025f80c198ee658bf9180a1580fc3ecf7db2529397c088975dd36fb651ba8e5d

Analysis

max time kernel
91s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 02:28

Target

025f80c198ee658bf9180a1580fc3ecf7db2529397c088975dd36fb651ba8e5d.dll
Size

9KB
MD5

6209ad1ec48ff1668d96737c826cd0e1
SHA1

ebfa1538cee07f0010bd9f17d23a8cb4bdc85bf9
SHA256

025f80c198ee658bf9180a1580fc3ecf7db2529397c088975dd36fb651ba8e5d
SHA512

9e149e62d5d14935260f3623cad2628d1c90a64892dce20bb5a4864f578c5c02a7fcccfef2a2dc0f0807d91b8a36a3d071a5eacf0e3699cabe047b9e30a8e273
SSDEEP

96:qJV7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34b:wuwEt8rsTUtPLzKNWSYWF4b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4940	4996	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 4996	4944	rundll32.exe	82
PID 4944 wrote to memory of 4996	4944	rundll32.exe	82
PID 4944 wrote to memory of 4996	4944	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\025f80c198ee658bf9180a1580fc3ecf7db2529397c088975dd36fb651ba8e5d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\025f80c198ee658bf9180a1580fc3ecf7db2529397c088975dd36fb651ba8e5d.dll,#1
  2⤵
  PID:4996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 624
    3⤵
    - Program crash
    PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4996 -ip 4996
1⤵
PID:4476

memory/4996-133-0x0000000000EE1000-0x0000000000EE3000-memory.dmp

Filesize
8KB

Download
memory/4996-134-0x0000000000EE1000-0x0000000000EE3000-memory.dmp

Filesize
8KB

Download
memory/4996-135-0x0000000000EE0000-0x0000000000EE7000-memory.dmp

Filesize
28KB

Download