648351ac3ca807bc0f72d0e63d3540690e62828a73b5f10351138b278b3f4f1d

Analysis

max time kernel
62s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 05:23

Target

648351ac3ca807bc0f72d0e63d3540690e62828a73b5f10351138b278b3f4f1d.dll
Size

46KB
MD5

1b8bb69248b8b81d580f30b107fdbb03
SHA1

7fe64dc878225de8af781b7cbb40f8db909af479
SHA256

648351ac3ca807bc0f72d0e63d3540690e62828a73b5f10351138b278b3f4f1d
SHA512

d8f5db7607ab604ef722e1e2c777eb1938f3d29c6fbcf299f5559111fec981a920a25f5be2e29b43b56ae7f87564782911ec6228e6f07e2773bf4f4883180552
SSDEEP

768:gYWN+3lG9Dl6kh26DJhaVd4znPFS74/SR8sj3I7H4Jy0GTtxZO6HiZurDy1Q88:gNNx3jXNPF8R77Ir70IZO2WcDy1v8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	3728	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3728	2548	rundll32.exe	80
PID 2548 wrote to memory of 3728	2548	rundll32.exe	80
PID 2548 wrote to memory of 3728	2548	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\648351ac3ca807bc0f72d0e63d3540690e62828a73b5f10351138b278b3f4f1d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\648351ac3ca807bc0f72d0e63d3540690e62828a73b5f10351138b278b3f4f1d.dll,#1
  2⤵
  PID:3728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 580
    3⤵
    - Program crash
    PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3728 -ip 3728
1⤵
PID:3356

memory/3728-133-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download