4af3fb26c6109e6ea89ab062fd14f9fc3ee399865ea191ec94310a1834c1ceea

Analysis

max time kernel
140s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 04:18

Target

4af3fb26c6109e6ea89ab062fd14f9fc3ee399865ea191ec94310a1834c1ceea.dll
Size

65KB
MD5

147c28afc51ab8cc08c58c5703e90ada
SHA1

4b807eafee5c4de2a916b473def2fa1dce1e222d
SHA256

4af3fb26c6109e6ea89ab062fd14f9fc3ee399865ea191ec94310a1834c1ceea
SHA512

a6a5508fc7ecd2ba7f65e72cb6bbc99f4ba0f1d308d93c8c2b2c0664de12256c06cc1da3c976cf11c84701236e53297694c91f3ede6792a62f874b683ad8fec6
SSDEEP

1536:Zwoq+LsVXPstyxi+16pBpaVUCUFrtFn64qx:ON+oVXEExEbpaVUPBtF6Jx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4796	4808	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4808	4460	rundll32.exe	81
PID 4460 wrote to memory of 4808	4460	rundll32.exe	81
PID 4460 wrote to memory of 4808	4460	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4af3fb26c6109e6ea89ab062fd14f9fc3ee399865ea191ec94310a1834c1ceea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4af3fb26c6109e6ea89ab062fd14f9fc3ee399865ea191ec94310a1834c1ceea.dll,#1
  2⤵
  PID:4808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 544
    3⤵
    - Program crash
    PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4808 -ip 4808
1⤵
PID:4748

memory/4808-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download