c86dd42f564dd64505d70fbf852bd5069d4dcf092fea145a125d49c219b4fb78

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2022 15:52

Target

1944-58-0x0000000000230000-0x000000000025A000-memory.dll
Size

168KB
MD5

3fc455fca17b55ccf7d5f38fdf1dc76f
SHA1

a78c3ce5c50f9925dda76170b18d99a6d4350c83
SHA256

c86dd42f564dd64505d70fbf852bd5069d4dcf092fea145a125d49c219b4fb78
SHA512

152464c4715572790303eccee2359e61854f36c8f12f0b82e10d0cdeb53f1f9c7580b04b30e20f7349abf363e6534f1dac79c32515d9f87cdcbfe1f7be433b6c
SSDEEP

3072:e4+nqaIS0aBTcgfWcY2ESbA+JDeedzMTBf1Mva83MeO/ya:fS0QTX+J2ESM+JxdzMTBt383MB/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5084 3504 WerFault.exe rundll32.exe

pid	pid_target	process	target process
5084	3504	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3172 wrote to memory of 3504	3172	rundll32.exe	rundll32.exe
PID 3172 wrote to memory of 3504	3172	rundll32.exe	rundll32.exe
PID 3172 wrote to memory of 3504	3172	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-58-0x0000000000230000-0x000000000025A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1944-58-0x0000000000230000-0x000000000025A000-memory.dll,#1
  2⤵
  PID:3504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 560
    3⤵
    - Program crash
    PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3504 -ip 3504
1⤵
PID:4508