46417a92098ef95aabbb3d2ff37896f7dd2535845e710370c95581d995cb4830

Analysis

max time kernel
151s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 11:50

Target

46417a92098ef95aabbb3d2ff37896f7dd2535845e710370c95581d995cb4830.dll
Size

117KB
MD5

6207cd8a0b15d75b558176f444ed9452
SHA1

3677aeaeab37dd142eebbaa094b74fbf3b5edc3c
SHA256

46417a92098ef95aabbb3d2ff37896f7dd2535845e710370c95581d995cb4830
SHA512

d75e86af2b9ba70cb715efc712e0d10b09bc8a181a6d024b18957a2b39dd5e945c17ee9626e9c573ab1fcffacea510357fac9a1aaac1ac946e8191c4d0e318e5
SSDEEP

3072:/h7QagTBoH0Gq/2c9VVUZNJPnMnbsprQP3/+wiu5bL:/h7x5H0G9crUNybjPmwig

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4428	4772	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 4772	4444	rundll32.exe	80
PID 4444 wrote to memory of 4772	4444	rundll32.exe	80
PID 4444 wrote to memory of 4772	4444	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46417a92098ef95aabbb3d2ff37896f7dd2535845e710370c95581d995cb4830.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\46417a92098ef95aabbb3d2ff37896f7dd2535845e710370c95581d995cb4830.dll,#1
  2⤵
  PID:4772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 612
    3⤵
    - Program crash
    PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4772 -ip 4772
1⤵
PID:3416

memory/4772-133-0x0000000000000000-mapping.dmp

Download
memory/4772-134-0x00000000011A0000-0x00000000011B1000-memory.dmp

Filesize
68KB

Download
memory/4772-135-0x0000000001370000-0x0000000001390000-memory.dmp

Filesize
128KB

Download
memory/4772-139-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4772-140-0x00000000011A0000-0x00000000011B1000-memory.dmp

Filesize
68KB

Download