bc92e039a4a5a966566338c65fa8767f71539be5dc4dda7a84e267693aff26f5

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2022 14:35

Target

872-58-0x0000000000170000-0x000000000019A000-memory.dll
Size

168KB
MD5

cf9d74b71a190efeff41b610389e91fb
SHA1

93486203bbf7b09b56cc328032788e26710f76c4
SHA256

bc92e039a4a5a966566338c65fa8767f71539be5dc4dda7a84e267693aff26f5
SHA512

7763bf2c0e4ef0d110465d9e3489fa128f4f76c0c0de5613785e8d98224e142ce7cd66fb8af43384a0363c48eacc92d3825b530490f4f98e3e36fab4f67b03c7
SSDEEP

3072:u4+rkxEnGHr/sfQwF5iFz9C98kP+EuDWQuvAmJXBdncTBfdQva83YKO/yaa:HxEnGHr/sfQw4z9ED29WQuYmJRdncTBe

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2616 648 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2616	648	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2804 wrote to memory of 648	2804	rundll32.exe	rundll32.exe
PID 2804 wrote to memory of 648	2804	rundll32.exe	rundll32.exe
PID 2804 wrote to memory of 648	2804	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\872-58-0x0000000000170000-0x000000000019A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\872-58-0x0000000000170000-0x000000000019A000-memory.dll,#1
  2⤵
  PID:648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 560
    3⤵
    - Program crash
    PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 648 -ip 648
1⤵
PID:4796