1216349165ea55d16d857816f2585865676db85b031eaa7c7e269ff39772f2bc

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 18:59

Target

1216349165ea55d16d857816f2585865676db85b031eaa7c7e269ff39772f2bc.dll
Size

9KB
MD5

84e1d6a9a76d550e805e7705531449e7
SHA1

ab3d9ebc29c0d8fcc3924ba8d3d8a56413ae7991
SHA256

1216349165ea55d16d857816f2585865676db85b031eaa7c7e269ff39772f2bc
SHA512

8b381b86114457ff9586cddcd8ba19ecdcfdd8e17dfb2a432ffbd8af09c8bc22e738c62cd48304b1876a7e150551f396a8f890b55e0e46405bfd64714703f040
SSDEEP

96:qJV7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34b2O:wuwEt8rsTUtPLzKNWSYWF4bN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
688	4480	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4480	4184	rundll32.exe	80
PID 4184 wrote to memory of 4480	4184	rundll32.exe	80
PID 4184 wrote to memory of 4480	4184	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1216349165ea55d16d857816f2585865676db85b031eaa7c7e269ff39772f2bc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1216349165ea55d16d857816f2585865676db85b031eaa7c7e269ff39772f2bc.dll,#1
  2⤵
  PID:4480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 628
    3⤵
    - Program crash
    PID:688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4480 -ip 4480
1⤵
PID:3112

memory/4480-133-0x00000000009F1000-0x00000000009F3000-memory.dmp

Filesize
8KB

Download
memory/4480-134-0x00000000009F0000-0x00000000009F7000-memory.dmp

Filesize
28KB

Download
memory/4480-135-0x00000000009F1000-0x00000000009F3000-memory.dmp

Filesize
8KB

Download
memory/4480-136-0x00000000009F0000-0x00000000009F7000-memory.dmp

Filesize
28KB

Download