56ab07240d746230de70db9ae5c801c1b9a1e8b9880fbd1b5e686f4aa585c882

Analysis

max time kernel
151s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 08:10

Target

56ab07240d746230de70db9ae5c801c1b9a1e8b9880fbd1b5e686f4aa585c882.dll
Size

57KB
MD5

931a85f96f68b394c8bf5d58ebdb45b1
SHA1

bfcd95d83a11c2de91c0f7832a47b20751372d4d
SHA256

56ab07240d746230de70db9ae5c801c1b9a1e8b9880fbd1b5e686f4aa585c882
SHA512

98a69cc5e947884430a14cd3006cd3d27fb41d7fc333d877984798a6f25e1742d77928f0817ba9ac615696788af8ecc790fc61a8762b2fc010a3cfe9d184e3b1
SSDEEP

768:xcxTSIVd3L2LQF10dwJVnO0NkYEmcxTK:xcxTSaYA0dAR1EmcxT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4920	2848	WerFault.exe	52

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 2848	1428	rundll32.exe	52
PID 1428 wrote to memory of 2848	1428	rundll32.exe	52
PID 1428 wrote to memory of 2848	1428	rundll32.exe	52

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56ab07240d746230de70db9ae5c801c1b9a1e8b9880fbd1b5e686f4aa585c882.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56ab07240d746230de70db9ae5c801c1b9a1e8b9880fbd1b5e686f4aa585c882.dll,#1
  2⤵
  PID:2848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 636
    3⤵
    - Program crash
    PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2848 -ip 2848
1⤵
PID:5004

memory/2848-133-0x0000000020000000-0x0000000020014000-memory.dmp

Filesize
80KB

Download