be7eb1cdb55eff4128f01ac9a2998dcd237c190e1ea9d0e84b639d8ef67e0eea

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 04:51

Target

be7eb1cdb55eff4128f01ac9a2998dcd237c190e1ea9d0e84b639d8ef67e0eea.dll
Size

235KB
MD5

0953536fc44c3a2dca665483a2b6cf57
SHA1

6e760e742daddc28525b2f4a4cb3017c52994740
SHA256

be7eb1cdb55eff4128f01ac9a2998dcd237c190e1ea9d0e84b639d8ef67e0eea
SHA512

cecb5616aad4181bab180bfcfe109a5046addcb923adf53b271dc9418aa7ee260318608e06ac41649846778cdeb4ec160dabdd60d775fed985470144add782da
SSDEEP

3072:nIvuqvKnQ4ZLameSfVXkUSI9I2pJd4taXhwJjfyqHvg3fR+cj4lU3C/RxOHIK:vdnVta3U1DrXwaqHI3DjU8C/RA5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3276	2320	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 2320	4788	rundll32.exe	81
PID 4788 wrote to memory of 2320	4788	rundll32.exe	81
PID 4788 wrote to memory of 2320	4788	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be7eb1cdb55eff4128f01ac9a2998dcd237c190e1ea9d0e84b639d8ef67e0eea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\be7eb1cdb55eff4128f01ac9a2998dcd237c190e1ea9d0e84b639d8ef67e0eea.dll,#1
  2⤵
  PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 572
    3⤵
    - Program crash
    PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2320 -ip 2320
1⤵
PID:4168

memory/2320-133-0x00000000010B0000-0x00000000010BB000-memory.dmp

Filesize
44KB

Download