9a2e935648b67cf135adda3087e3a112c2e5bce1dbd7e791bf658331236cbad4

Analysis

max time kernel
185s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 13:32

Target

9a2e935648b67cf135adda3087e3a112c2e5bce1dbd7e791bf658331236cbad4.dll
Size

68KB
MD5

0dd420cd7b56e9c7530aec29e04cf506
SHA1

ad4a7731b7a3077564df84610bad79f8bb3fb17d
SHA256

9a2e935648b67cf135adda3087e3a112c2e5bce1dbd7e791bf658331236cbad4
SHA512

b2fc1c8af590ce088f478f3a228e5292d9bdf72d144d5941453d51fbf7880ee6e347544aab816c858b8f7ff238c353fd3f6a882fdc22039e16185b78c3756f08
SSDEEP

1536:n2NNyGkHjkDzELuOtCJS5uEk7od2eq6Kav/glnReOed/qSriW9kQ:nuAGWIz8CJS5uuJq6Kq/sReOyX5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3472	5060	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 5060	5084	rundll32.exe	80
PID 5084 wrote to memory of 5060	5084	rundll32.exe	80
PID 5084 wrote to memory of 5060	5084	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a2e935648b67cf135adda3087e3a112c2e5bce1dbd7e791bf658331236cbad4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a2e935648b67cf135adda3087e3a112c2e5bce1dbd7e791bf658331236cbad4.dll,#1
  2⤵
  PID:5060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 544
    3⤵
    - Program crash
    PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5060 -ip 5060
1⤵
PID:5076

memory/5060-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download