83476deada6ae63370d1836f9c5855f5a207d119fb27e62faa54c40848eee945

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 20:59

Target

83476deada6ae63370d1836f9c5855f5a207d119fb27e62faa54c40848eee945.dll
Size

172KB
MD5

0d25222b9e73cd8f6e7184d402aba370
SHA1

4f250b949b9e9555d3513345649a468d334fdd2f
SHA256

83476deada6ae63370d1836f9c5855f5a207d119fb27e62faa54c40848eee945
SHA512

7c9b0f9793d6c64f38b7c263fdc5c140c3ed4c1fba897b14d3b802fbb30e7785c2893325f9d295567bbca7206a881d1a20d6166ba1df57fb3124dd0b8216573b
SSDEEP

3072:UsJktXqkaAp78heywCtFUulj713gvDrTCsvhWb6vpCf1gneA/z7:AtXqkaa4hzwy7UDwgI1Yek

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4444	1664	WerFault.exe	58

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 1664	5104	rundll32.exe	58
PID 5104 wrote to memory of 1664	5104	rundll32.exe	58
PID 5104 wrote to memory of 1664	5104	rundll32.exe	58

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83476deada6ae63370d1836f9c5855f5a207d119fb27e62faa54c40848eee945.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\83476deada6ae63370d1836f9c5855f5a207d119fb27e62faa54c40848eee945.dll,#1
  2⤵
  PID:1664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 600
    3⤵
    - Program crash
    PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1664 -ip 1664
1⤵
PID:5028

memory/1664-133-0x000000006D0C0000-0x000000006D0EB000-memory.dmp

Filesize
172KB

Download