b425191459cf2484947421d67e3897593edd182e2573c89d62787d0e9e4af8e1

Analysis

max time kernel
93s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2022 05:25

Target

b425191459cf2484947421d67e3897593edd182e2573c89d62787d0e9e4af8e1.dll
Size

54KB
MD5

714bc2bccb4e8fe09503c3f62866bba4
SHA1

4fb30d54279c9f08893cb46ab71c26bd4f504133
SHA256

b425191459cf2484947421d67e3897593edd182e2573c89d62787d0e9e4af8e1
SHA512

645ebe048f017295d4ca9880a1ef4cf155aea6520093493192e91ee609961306f82f6614ad20f96d134dd6996e34e0603d0f0a20b7fb500d2814aa9972de9b8c
SSDEEP

768:trY2Z1EDhOFQjkVNOSPPLLKnpJjn1LyC8p0+mtGAMoci/mU5QyLP20Pa2KJJRT+C:h/4DYyjkxP/Cj1mCJEroSwT7gT+VMo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3844	4920	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 4920	4176	rundll32.exe	82
PID 4176 wrote to memory of 4920	4176	rundll32.exe	82
PID 4176 wrote to memory of 4920	4176	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b425191459cf2484947421d67e3897593edd182e2573c89d62787d0e9e4af8e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b425191459cf2484947421d67e3897593edd182e2573c89d62787d0e9e4af8e1.dll,#1
  2⤵
  PID:4920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 544
    3⤵
    - Program crash
    PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4920 -ip 4920
1⤵
PID:2472

memory/4920-132-0x0000000000000000-mapping.dmp

Download
memory/4920-133-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download