f09eac8e2eb4e06370f8fafd5740b60f7d1d50e86677312ae197632247f5efb3

Analysis

max time kernel
74s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 17:49

Target

f09eac8e2eb4e06370f8fafd5740b60f7d1d50e86677312ae197632247f5efb3.dll
Size

276KB
MD5

82d41cb010e049916f2591e6e979f236
SHA1

312d0310da9ed0a24b5ed3303157850c53d173cc
SHA256

f09eac8e2eb4e06370f8fafd5740b60f7d1d50e86677312ae197632247f5efb3
SHA512

85cde441901aaf976c5e31ea0684c58b9c2bcf86e70555df987edc19e58215793acd20cb628f55ef371f3acad7d7840b64a700e881a38175d7175a4d1688f2a1
SSDEEP

6144:xwjNbH0iRP3iIkktCG8YXXO8/dOogWuF3RMyFqi9akKP:mjhHVRfiIpZ3FOzXRSiX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1448	4876	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4876	4396	rundll32.exe	80
PID 4396 wrote to memory of 4876	4396	rundll32.exe	80
PID 4396 wrote to memory of 4876	4396	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f09eac8e2eb4e06370f8fafd5740b60f7d1d50e86677312ae197632247f5efb3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f09eac8e2eb4e06370f8fafd5740b60f7d1d50e86677312ae197632247f5efb3.dll,#1
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 572
    3⤵
    - Program crash
    PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4876 -ip 4876
1⤵
PID:4952

memory/4876-133-0x0000000073760000-0x00000000737AD000-memory.dmp

Filesize
308KB

Download