f63786523bf83a9c8979951bf5e8d71ff0b92f05411ba975bfecdbdc7d221751

Analysis

max time kernel
505s
max time network
508s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2022, 05:22

Target

3a1c350e3fcd95acc2c6d1281a4e6c81a75a9678f4e4c55a417e011cd1400796_dump_0x20030000.dll
Size

44KB
MD5

544bd9a9c36403aba36d5b51f4a0064a
SHA1

c388e2d83943a097271b4f720007ff61bbecb617
SHA256

f63786523bf83a9c8979951bf5e8d71ff0b92f05411ba975bfecdbdc7d221751
SHA512

f2ad4b5159899ec69167fc01032b726b925e75714d494162cff876f2eb86145748dae4c7b76ba69359dd618c05aee1363d30e73208af2046f3e3768a0915f3e6
SSDEEP

768:GbDYc+9e+oRuNuTZGj+UNgTJb5K5APogYWED0:Gb0GQNuMj+UE5K5rWED

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5020	3384	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 3384	516	rundll32.exe	81
PID 516 wrote to memory of 3384	516	rundll32.exe	81
PID 516 wrote to memory of 3384	516	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a1c350e3fcd95acc2c6d1281a4e6c81a75a9678f4e4c55a417e011cd1400796_dump_0x20030000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a1c350e3fcd95acc2c6d1281a4e6c81a75a9678f4e4c55a417e011cd1400796_dump_0x20030000.dll,#1
  2⤵
  PID:3384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 564
    3⤵
    - Program crash
    PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3384 -ip 3384
1⤵
PID:5040