762f9c676c1ebd9493e3ed7c5e4d1673457190484e6b52c51bcfbcc3cd366a39

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 12:45

Target

762f9c676c1ebd9493e3ed7c5e4d1673457190484e6b52c51bcfbcc3cd366a39.dll
Size

9KB
MD5

a29a68fc66533f63be44e8d84d7595a0
SHA1

b6f92b7ff63c810c5ba99b02f6a9aca14e34a212
SHA256

762f9c676c1ebd9493e3ed7c5e4d1673457190484e6b52c51bcfbcc3cd366a39
SHA512

6ceadb3a8cb31f151bfbaee7b0ec817e5a2776c264761abb3119c09cfee9159f0c5370c2a9f15b8e3fba597f9c027a5f2432231a1539a896b4fb472abc66ef7d
SSDEEP

192:sNo5kmXmEEnkITKoUBQIEtNvokhF5hDJtKfnv23qJthDN:i1mWEHI2oT7Nh9Dqv6qJtN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1604	4296	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 4296	3400	rundll32.exe	80
PID 3400 wrote to memory of 4296	3400	rundll32.exe	80
PID 3400 wrote to memory of 4296	3400	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\762f9c676c1ebd9493e3ed7c5e4d1673457190484e6b52c51bcfbcc3cd366a39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\762f9c676c1ebd9493e3ed7c5e4d1673457190484e6b52c51bcfbcc3cd366a39.dll,#1
  2⤵
  PID:4296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 616
    3⤵
    - Program crash
    PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4296 -ip 4296
1⤵
PID:1084

memory/4296-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4296-134-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download