f45105ec0ab7988bdb0f12ac19dde5ca81bb35222336c0728b3cc57ee1f41602

Analysis

max time kernel
92s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 05:15

Target

f45105ec0ab7988bdb0f12ac19dde5ca81bb35222336c0728b3cc57ee1f41602.dll
Size

1019KB
MD5

76f5f92e842deaee0a9ae294a8fba14c
SHA1

649d21eb9180289a4322531e855fb675ded1972d
SHA256

f45105ec0ab7988bdb0f12ac19dde5ca81bb35222336c0728b3cc57ee1f41602
SHA512

81d5ec09568b6beaffce5fc52213e059a78a894fc32454b58371d5c0160e732cfa9ace5171ea4297dc349c8e1e4fb2db13f4dc6ec99d136fc50ca70d9d6609be
SSDEEP

3072:r0JICuUIpFfGUOojYmJAZf+KNDrLznlN3wtqFXXbmWq1Lqf5HsYsKdv8Kr8fby:cICKpMPW9Gf+KNDznlg2ALeHrd3r8W

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1328	4892	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4892	4988	rundll32.exe	81
PID 4988 wrote to memory of 4892	4988	rundll32.exe	81
PID 4988 wrote to memory of 4892	4988	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f45105ec0ab7988bdb0f12ac19dde5ca81bb35222336c0728b3cc57ee1f41602.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f45105ec0ab7988bdb0f12ac19dde5ca81bb35222336c0728b3cc57ee1f41602.dll,#1
  2⤵
  PID:4892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 624
    3⤵
    - Program crash
    PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4892 -ip 4892
1⤵
PID:4864

memory/4892-133-0x0000000002330000-0x0000000002343000-memory.dmp

Filesize
76KB

Download