bf19dddd8f19310e7bc6fd52acac1e60ee43256c3bbf236c4299df83d972b8d0

Analysis

max time kernel
112s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 07:34

Target

bf19dddd8f19310e7bc6fd52acac1e60ee43256c3bbf236c4299df83d972b8d0.dll
Size

31KB
MD5

311d16a5e9793aba5c27e1b08aacb790
SHA1

fec0afade9c12f9597d50d7a0caccd20710b502d
SHA256

bf19dddd8f19310e7bc6fd52acac1e60ee43256c3bbf236c4299df83d972b8d0
SHA512

0295a299e16ab463769942e082d801f5ef3f8dfff2751729265584892144f473ef8b78f0293fc6b415faba638c4cd2da83a6c22a765e09f1cb10e457d46cbc54
SSDEEP

768:5oiEqZOfQ4o/w429v0ihN3UUC/e7ubj04F5Bn:5vEqZ2Qh/skUCW7mLhn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1780	2524	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2524	1628	rundll32.exe	80
PID 1628 wrote to memory of 2524	1628	rundll32.exe	80
PID 1628 wrote to memory of 2524	1628	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf19dddd8f19310e7bc6fd52acac1e60ee43256c3bbf236c4299df83d972b8d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf19dddd8f19310e7bc6fd52acac1e60ee43256c3bbf236c4299df83d972b8d0.dll,#1
  2⤵
  PID:2524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 628
    3⤵
    - Program crash
    PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2524 -ip 2524
1⤵
PID:3940

memory/2524-133-0x00000000007A0000-0x00000000007AE000-memory.dmp

Filesize
56KB

Download