d69191a657e880854050b9d301ccb079910cbb4fbad6dee452ae31c79cb7feda

Analysis

max time kernel
167s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 23:23

Target

d69191a657e880854050b9d301ccb079910cbb4fbad6dee452ae31c79cb7feda.dll
Size

293KB
MD5

05fedd1a1c78fcef6ff6ddda5b490d10
SHA1

52f2059f92fa68b98000a9cc9c54e1e669ca659e
SHA256

d69191a657e880854050b9d301ccb079910cbb4fbad6dee452ae31c79cb7feda
SHA512

5434215475b7ad17ca00f49abd9c9724ab7d2318cdc4b7fe0b39ad6cdd6062f8831e13a264af7bfaf692a61fac119437465f613baaf786fcac89d6806c4c4a3c
SSDEEP

6144:bXztUh19gGaO4HCEfBmqO/JO9YZzovGSkGBOEy1zqAHZ:lyOiWBmTkyBS61nHZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4064	4396	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 4396	1276	rundll32.exe	80
PID 1276 wrote to memory of 4396	1276	rundll32.exe	80
PID 1276 wrote to memory of 4396	1276	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d69191a657e880854050b9d301ccb079910cbb4fbad6dee452ae31c79cb7feda.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d69191a657e880854050b9d301ccb079910cbb4fbad6dee452ae31c79cb7feda.dll,#1
  2⤵
  PID:4396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 656
    3⤵
    - Program crash
    PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4396 -ip 4396
1⤵
PID:1544

memory/4396-133-0x0000000000570000-0x00000000005ED000-memory.dmp

Filesize
500KB

Download
memory/4396-134-0x0000000000570000-0x00000000005ED000-memory.dmp

Filesize
500KB

Download
memory/4396-135-0x0000000000570000-0x00000000005ED000-memory.dmp

Filesize
500KB

Download