2394cac4a66cfc728bf0cfe7f1a13ad2fc4999895478fc15b58ed2c6bd2b91e9

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 10:24

Target
2394cac4a66cfc728bf0cfe7f1a13ad2fc4999895478fc15b58ed2c6bd2b91e9.dll
Size 414KB
Sample221106-mfes6sfde4
SHA256 2394cac4a66cfc728bf0cfe7f1a13ad2fc4999895478fc15b58ed2c6bd2b91e9
MD5 10a327e4ea51dc054e6aabb1262bfffb
SHA1 97f93e7b410d3f8bb98f17b0a0ee9d8131032b84
SHA512 ff3dc6e5a65b9943f016d25b59db2391087d873c5840e5d70969ab148b7c17a9bd2fcd221ac1ae2094579a1117e9a2e744974ff584da00c0bb7c173894b2e0f8
SSDEEP 6144:Jjem4TNEZKYi4x0sf5Ry26QPTyHGhYQCW3e0dZfFgCZTdsmnElHcb1QW40DL7BBi:JUEJx0CRqg1dTdxGmnOI1QpSsh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3444	2748	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 2748	4676	rundll32.exe	80
PID 4676 wrote to memory of 2748	4676	rundll32.exe	80
PID 4676 wrote to memory of 2748	4676	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2394cac4a66cfc728bf0cfe7f1a13ad2fc4999895478fc15b58ed2c6bd2b91e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2394cac4a66cfc728bf0cfe7f1a13ad2fc4999895478fc15b58ed2c6bd2b91e9.dll,#1
  2⤵
  PID:2748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 688
    3⤵
    - Program crash
    PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2748 -ip 2748
1⤵
PID:1280

memory/2748-133-0x0000000001040000-0x00000000010C2000-memory.dmp

Download

memory/2748-134-0x0000000001120000-0x000000000116B000-memory.dmp

Download