b0e16835eb749548e50fd0b26fd366cfbde46b3855cadd043e38016ada7832b2

Analysis

max time kernel
106s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2022, 09:05

Target

1044-57-0x00000000007D0000-0x00000000007FA000-memory.dll
Size

168KB
MD5

9368d9192ccacd5778db1ad903be9875
SHA1

d9f81a2d1c1d39a343344f009424ce41a2a842ca
SHA256

b0e16835eb749548e50fd0b26fd366cfbde46b3855cadd043e38016ada7832b2
SHA512

5a470b9a436205162105f09250e61cff1ff66b6432cd01862d3e40bd5bc7873567e63133ace3ec5105dac4402f8b2b8128501487f3502d01294562e883c03b38
SSDEEP

3072:4/n9wM9+9FOXcfeFpAkJ8glJATBfpPgcoO/yaxX1:mQeMfeFikJPlJATBhPLr/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1352	4184	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 4184	740	rundll32.exe	80
PID 740 wrote to memory of 4184	740	rundll32.exe	80
PID 740 wrote to memory of 4184	740	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1044-57-0x00000000007D0000-0x00000000007FA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1044-57-0x00000000007D0000-0x00000000007FA000-memory.dll,#1
  2⤵
  PID:4184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 560
    3⤵
    - Program crash
    PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4184 -ip 4184
1⤵
PID:3792