c822d7324daf25b618ed699b2ed342cbf83e6ae0729578a1b4a5667bfc262340

Analysis

max time kernel
178s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 16:50

Target

c822d7324daf25b618ed699b2ed342cbf83e6ae0729578a1b4a5667bfc262340.dll
Size

67KB
MD5

832ba51ea54b8aa8cc5fdc171722d5d2
SHA1

d8a9afae6d851eb38059c7a1b9b4b7d5e7d78c55
SHA256

c822d7324daf25b618ed699b2ed342cbf83e6ae0729578a1b4a5667bfc262340
SHA512

5c4fefac758cf266125bb497d04e38017fc72ccd040cc6fbd45f623d3dd42a6d7f9ff803aa8f59cb8b18dc5b715054392b69f78da4274d10872bc1fa175559aa
SSDEEP

1536:uwoq+LsVXPTtuM/rU9qlr2P8dZa/X7iQd0scpxOc3vg4:hN+oVXEMTUcK0SiQd0smxM4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	2764	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2764	2240	rundll32.exe	79
PID 2240 wrote to memory of 2764	2240	rundll32.exe	79
PID 2240 wrote to memory of 2764	2240	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c822d7324daf25b618ed699b2ed342cbf83e6ae0729578a1b4a5667bfc262340.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c822d7324daf25b618ed699b2ed342cbf83e6ae0729578a1b4a5667bfc262340.dll,#1
  2⤵
  PID:2764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 560
    3⤵
    - Program crash
    PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2764 -ip 2764
1⤵
PID:764

memory/2764-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download