40e0d22328269869909561c6859d9d26b426d86c4b4f138ae76d5d12d89d83df

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 22:47

Target

40e0d22328269869909561c6859d9d26b426d86c4b4f138ae76d5d12d89d83df.dll
Size

692KB
MD5

55f70000350289159ddd25d84d57ffa0
SHA1

57648522f59352c294e4facd7c5831c49bf1f919
SHA256

40e0d22328269869909561c6859d9d26b426d86c4b4f138ae76d5d12d89d83df
SHA512

62d02e6511319a062f6f8d618ed43bbe7877b01b2c9913471ceebba0ec3959919d618aab3a5b5dbde52107a2f335423f417c26ed5fd130570eb58cbe0032f5ea
SSDEEP

6144:JFkG1O7k0CDLrprn9IvWpZkj40eGULe17eHwduyptfv3gIKMvv3ztK:Ja6k6uWTkj9/FXptLBfztK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3076	3264	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 3264	4980	rundll32.exe	83
PID 4980 wrote to memory of 3264	4980	rundll32.exe	83
PID 4980 wrote to memory of 3264	4980	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40e0d22328269869909561c6859d9d26b426d86c4b4f138ae76d5d12d89d83df.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40e0d22328269869909561c6859d9d26b426d86c4b4f138ae76d5d12d89d83df.dll,#1
  2⤵
  PID:3264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 564
    3⤵
    - Program crash
    PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3264 -ip 3264
1⤵
PID:944

memory/3264-132-0x0000000000000000-mapping.dmp

Download
memory/3264-133-0x0000000010000000-0x00000000100B4000-memory.dmp

Filesize
720KB

Download
memory/3264-134-0x0000000010000000-0x00000000100B4000-memory.dmp

Filesize
720KB

Download