5ff74fe96343c867304ef6d1c8345612080173b43bdfeedb3ce556879116f250

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 19:48

Target

5ff74fe96343c867304ef6d1c8345612080173b43bdfeedb3ce556879116f250.dll
Size

118KB
MD5

0ece7c16f580d24c0c930489982392d5
SHA1

32e2f19975022f3e3b6783d79406c0d01bb44294
SHA256

5ff74fe96343c867304ef6d1c8345612080173b43bdfeedb3ce556879116f250
SHA512

9fe58956eb001204d9393d305d63368bfcee761d9c4d2ac166a06d2cafd76de7fe66bcb0db72bfb8a11e5cf52fa9bb34fa96f3d8f3d6b0bb29c4a98d4bf965f3
SSDEEP

3072:/dngK7aidAEMG3hjHZdri+z6gBSOHZIJ5idPidfmiRDmdZ:/h77liNAviS5ZUsi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4496	3284	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3284	1104	rundll32.exe	80
PID 1104 wrote to memory of 3284	1104	rundll32.exe	80
PID 1104 wrote to memory of 3284	1104	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ff74fe96343c867304ef6d1c8345612080173b43bdfeedb3ce556879116f250.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ff74fe96343c867304ef6d1c8345612080173b43bdfeedb3ce556879116f250.dll,#1
  2⤵
  PID:3284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 572
    3⤵
    - Program crash
    PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3284 -ip 3284
1⤵
PID:680

memory/3284-133-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download