2608c617af826bda1596fe4c593e0bc074f64efaa4bd34b82b64ee42a494e92e

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 08:26

Target

2608c617af826bda1596fe4c593e0bc074f64efaa4bd34b82b64ee42a494e92e.dll
Size

139KB
MD5

93060232ba5bbd9adf4e92167dde8098
SHA1

eab603d0267118ffdad3d25e0f8e090af573a41c
SHA256

2608c617af826bda1596fe4c593e0bc074f64efaa4bd34b82b64ee42a494e92e
SHA512

73818e23cae81c31cce2761ab71f22c30c879373cbb80d18451906683980fd7ea93e91d2989d8cbbb93b78be2f54c9804267003843e0a14bf17b51755ac1de56
SSDEEP

3072:epyzMzZD8UPM4uaFd0sACCbNi3WwgC7Y8Xb8Y+o/:7AND8OMVpsAQ32Yn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2424	1260	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1260	4376	rundll32.exe	81
PID 4376 wrote to memory of 1260	4376	rundll32.exe	81
PID 4376 wrote to memory of 1260	4376	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2608c617af826bda1596fe4c593e0bc074f64efaa4bd34b82b64ee42a494e92e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2608c617af826bda1596fe4c593e0bc074f64efaa4bd34b82b64ee42a494e92e.dll,#1
  2⤵
  PID:1260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 552
    3⤵
    - Program crash
    PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1260 -ip 1260
1⤵
PID:5092

memory/1260-133-0x0000000010000000-0x000000001003A000-memory.dmp

Filesize
232KB

Download