c99f23d30ce0c06537cad5bc664d29e00173430db1bea6613150fcdba7fdb55d

Analysis

max time kernel
151s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 18:16

Target

c99f23d30ce0c06537cad5bc664d29e00173430db1bea6613150fcdba7fdb55d.dll
Size

10KB
MD5

0e13dd93d6b755667409f7b18ca5e75e
SHA1

1e81356dee9f36de0d43c59be1b12b2b17bd2755
SHA256

c99f23d30ce0c06537cad5bc664d29e00173430db1bea6613150fcdba7fdb55d
SHA512

a3894fe0ed6e15d0af208f30516c1e0322aff7f3924803c60fa73809c9a66ea8e56b3471506f16eeff90c281258e6e016936b9c2b14766245409cdfcd6affd63
SSDEEP

192:Fw8dHabRDEgtHyl0NSypWak6HVdW3yWak8QjdW3w9wv:ndHad/N20IypWak8dWiWak8EdWN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5020	1168	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 1168	3196	rundll32.exe	80
PID 3196 wrote to memory of 1168	3196	rundll32.exe	80
PID 3196 wrote to memory of 1168	3196	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c99f23d30ce0c06537cad5bc664d29e00173430db1bea6613150fcdba7fdb55d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c99f23d30ce0c06537cad5bc664d29e00173430db1bea6613150fcdba7fdb55d.dll,#1
  2⤵
  PID:1168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 560
    3⤵
    - Program crash
    PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1168 -ip 1168
1⤵
PID:5064

memory/1168-133-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download
memory/1168-134-0x000000006DD20000-0x000000006DD27000-memory.dmp

Filesize
28KB

Download