bc579430aa3b40acf11dc53727f1395e99133e1312a43699ef89325747c631ff

Analysis

max time kernel
508s
max time network
512s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2022, 05:21

Target

b534d55f384f4a2f9f8762ccd360a7c5d3fbd9ba15b1671e4a3629ef69a4472b_dump_0x009B0000.dll
Size

220KB
MD5

f3fb575e407134d58b38731d08742bc7
SHA1

c49e1e63f172bda968c3d40dad05559324692dca
SHA256

bc579430aa3b40acf11dc53727f1395e99133e1312a43699ef89325747c631ff
SHA512

e355d2c204465341c9d4cd583f796de12f3fb6e192f24cca5438f4ce078af4434523fc48ae32a291b75f49dafb45084f7f90d06dafc36014b95090fc1a9cf17d
SSDEEP

3072:cYOXAOSr/k77OEX8JUoar8hEzZ8M5m4opVhO1IaCLWRbWm6bNbqoaf:jOSDM7zX86jrOEL4VhqfCmbQ1qX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4268	3444	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 3444	1568	rundll32.exe	80
PID 1568 wrote to memory of 3444	1568	rundll32.exe	80
PID 1568 wrote to memory of 3444	1568	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b534d55f384f4a2f9f8762ccd360a7c5d3fbd9ba15b1671e4a3629ef69a4472b_dump_0x009B0000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b534d55f384f4a2f9f8762ccd360a7c5d3fbd9ba15b1671e4a3629ef69a4472b_dump_0x009B0000.dll,#1
  2⤵
  PID:3444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 544
    3⤵
    - Program crash
    PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3444 -ip 3444
1⤵
PID:4200