dd73e3fcfba58ee5e6c233173593541135647d2ae346d5351f11f12172102cd3

Analysis

max time kernel
106s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2022 21:30

Target

884-58-0x00000000001F0000-0x000000000021A000-memory.dll
Size

168KB
MD5

be4bb6b807a9720722ec36a41c31b66c
SHA1

ee0afbbcd145c0c9969a2d29644f7af176ddb9da
SHA256

dd73e3fcfba58ee5e6c233173593541135647d2ae346d5351f11f12172102cd3
SHA512

39d7a409fe2ad31fa758631ab379bdf2d2ef6b5868a7a896a1a9b871fdefabb40904b681aae3f83d9a2d22cdedc9d5642e9acc82efbee594fb0f03d81298c04e
SSDEEP

3072:s/VpdEmPMtlysJX4LvA4Jm6t5UTBfdFg0UO/yaxX1:sz0SsJX4LY4JDt5UTBVFL//

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1736 1592 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1736	1592	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2224 wrote to memory of 1592	2224	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 1592	2224	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 1592	2224	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\884-58-0x00000000001F0000-0x000000000021A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\884-58-0x00000000001F0000-0x000000000021A000-memory.dll,#1
2⤵
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 560
3⤵
- Program crash
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1592 -ip 1592
1⤵
PID:2508