89890ffe85a326965dc7adc08aacfacba983396f66ec5f58bc9fdd642d3cc6c6

Analysis

max time kernel
90s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 17:14

Target

89890ffe85a326965dc7adc08aacfacba983396f66ec5f58bc9fdd642d3cc6c6.dll
Size

10KB
MD5

82a2e89e639de8a7d5b01be07f73c68d
SHA1

3a155de7015ebda880de4791e6090e642ddf90b9
SHA256

89890ffe85a326965dc7adc08aacfacba983396f66ec5f58bc9fdd642d3cc6c6
SHA512

e253acd5cc72429f75f6f564c178fca9b1c080e719a2c85cfb2367b3719f0fb4f10b27b93353adce66ad680d2196695e4cc138cb58ffdcb878b2f941013a0bf3
SSDEEP

192:Z1mjfw8dHabRDEgzHyl0NSyFWakiP84dW3qWak8Q7dW3o9wv:Z8jhdHad/z20IyFWakC84dWaWak8cdWV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4568	4964	WerFault.exe	69

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 4964	4284	rundll32.exe	69
PID 4284 wrote to memory of 4964	4284	rundll32.exe	69
PID 4284 wrote to memory of 4964	4284	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\89890ffe85a326965dc7adc08aacfacba983396f66ec5f58bc9fdd642d3cc6c6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\89890ffe85a326965dc7adc08aacfacba983396f66ec5f58bc9fdd642d3cc6c6.dll,#1
  2⤵
  PID:4964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 552
    3⤵
    - Program crash
    PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4964 -ip 4964
1⤵
PID:2976

memory/4964-133-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download
memory/4964-134-0x000000006DD20000-0x000000006DD27000-memory.dmp

Filesize
28KB

Download