32e1e706deb323e773f5081b3cf7391fc258604d50e512298903f02bc60625ad

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 22:52

Target

32e1e706deb323e773f5081b3cf7391fc258604d50e512298903f02bc60625ad.dll
Size

170KB
MD5

844bb3da1bbd49324e91a815c84302ec
SHA1

7746eaa21ac81d55123f753da7cf2781a8945415
SHA256

32e1e706deb323e773f5081b3cf7391fc258604d50e512298903f02bc60625ad
SHA512

57125e6c412d0615d51e400c4875c3b4d5bc577c61588d7342276202b2dedd44b580af1448b34368a5a1229eeee708a2bf390fff99569cd5cfe3b408637ba8f5
SSDEEP

3072:25jAaL17ZppHO5lV+EHfjvEnZumUPiwMMQVFfT3CFpt9P6oCub:ZVRHbvsSPiwMlvmFZcu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	4616	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 4616	652	rundll32.exe	83
PID 652 wrote to memory of 4616	652	rundll32.exe	83
PID 652 wrote to memory of 4616	652	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32e1e706deb323e773f5081b3cf7391fc258604d50e512298903f02bc60625ad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32e1e706deb323e773f5081b3cf7391fc258604d50e512298903f02bc60625ad.dll,#1
  2⤵
  PID:4616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 612
    3⤵
    - Program crash
    PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4616 -ip 4616
1⤵
PID:1420

memory/4616-133-0x0000000000700000-0x0000000000714000-memory.dmp

Filesize
80KB

Download
memory/4616-134-0x0000000000790000-0x00000000007BD000-memory.dmp

Filesize
180KB

Download
memory/4616-138-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/4616-139-0x0000000000700000-0x0000000000714000-memory.dmp

Filesize
80KB

Download