6de90492c26d0a32f84964f736934fd799c964cfddfc82a677805373f4469687

Analysis

max time kernel
92s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 18:45

Target

6de90492c26d0a32f84964f736934fd799c964cfddfc82a677805373f4469687.dll
Size

65KB
MD5

01df2b61c2400fefdc462a283e671f01
SHA1

31580e11e6fa351aa0f214d48cbbc7cd2a493be3
SHA256

6de90492c26d0a32f84964f736934fd799c964cfddfc82a677805373f4469687
SHA512

4bfa8ec5238aeaec68ba787d04eb0776d55ac5aa4e6ab7260df4c54173ca2afa94398c714484804b0a12a9c64356d5c627c9a715cdd444226012448c269617d3
SSDEEP

1536:JpcvBq2h8vAqBDp3B9LvEfh71KjrF6SL3WqfXQN1B7lhS0:Jp+hLGpxNE1Ujpt3Z43NS0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3884	764	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 764	1144	rundll32.exe	80
PID 1144 wrote to memory of 764	1144	rundll32.exe	80
PID 1144 wrote to memory of 764	1144	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6de90492c26d0a32f84964f736934fd799c964cfddfc82a677805373f4469687.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6de90492c26d0a32f84964f736934fd799c964cfddfc82a677805373f4469687.dll,#1
  2⤵
  PID:764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 544
    3⤵
    - Program crash
    PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 764 -ip 764
1⤵
PID:2076

memory/764-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download