c1bee37a1b36bf0277f6b97a0c06e40963d6dfe8642677e0df01366ebde2dbad

Analysis

max time kernel
153s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 16:11

Target

c1bee37a1b36bf0277f6b97a0c06e40963d6dfe8642677e0df01366ebde2dbad.dll
Size

915KB
MD5

066c9229aaf7d9336efdf6253a582150
SHA1

0991630ee9d9c8f3ede0984f0595a42230d7959f
SHA256

c1bee37a1b36bf0277f6b97a0c06e40963d6dfe8642677e0df01366ebde2dbad
SHA512

6fb05655a83a9a6a8655c351dbc2b6664b8a350663a14183b2272a5e135dbd37c7f2ce9b2bcdd6e325d06af28e3c35c047df712b19a0377c11dc08bc01d5c202
SSDEEP

12288:5saDxRv9OjVrhWrTMHU9S/gbjD9jSg1cElgbo3GNkxkCyEAdMbsRMN/AEYuJ4AWp:5s+ErWMHU9DhtCWg2xAEdNUfJTA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4848	4960	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 4960	2268	rundll32.exe	80
PID 2268 wrote to memory of 4960	2268	rundll32.exe	80
PID 2268 wrote to memory of 4960	2268	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1bee37a1b36bf0277f6b97a0c06e40963d6dfe8642677e0df01366ebde2dbad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1bee37a1b36bf0277f6b97a0c06e40963d6dfe8642677e0df01366ebde2dbad.dll,#1
  2⤵
  PID:4960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 644
    3⤵
    - Program crash
    PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4960 -ip 4960
1⤵
PID:4032

memory/4960-132-0x0000000000000000-mapping.dmp

Download
memory/4960-133-0x0000000010000000-0x0000000010144000-memory.dmp

Filesize
1.3MB

Download