c029afd1b292ca72e3a9c514c1d75a211e7b17bd7c76bd3ed5bc506f1fd660c9

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 19:41

Target

c029afd1b292ca72e3a9c514c1d75a211e7b17bd7c76bd3ed5bc506f1fd660c9.dll
Size

42KB
MD5

0de4757e1a14461cf9b5f4a2f11e7d6b
SHA1

7b1ac3ed259fa530c6a6b311517e0fa31da5dad4
SHA256

c029afd1b292ca72e3a9c514c1d75a211e7b17bd7c76bd3ed5bc506f1fd660c9
SHA512

83a00ad111a7be4ba2df67ca849618a4caf948301146a95a21eda2e1560e6194ef35571f03701390e32356bfa668ab952807ceae80208193d1098985e562700b
SSDEEP

768:7iODp22Zb9q8U1ewb6x1U8UfbMGKSbPwh1WDqUVyqK+GSvWBu:7iI22Z+0wb6x1YchlU4HS8u

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	376	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 376	1100	rundll32.exe	80
PID 1100 wrote to memory of 376	1100	rundll32.exe	80
PID 1100 wrote to memory of 376	1100	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c029afd1b292ca72e3a9c514c1d75a211e7b17bd7c76bd3ed5bc506f1fd660c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c029afd1b292ca72e3a9c514c1d75a211e7b17bd7c76bd3ed5bc506f1fd660c9.dll,#1
  2⤵
  PID:376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 592
    3⤵
    - Program crash
    PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 376 -ip 376
1⤵
PID:1324

memory/376-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download