33dcd71f19c78e6f8912f191d7c797c735ef719c34847d70455094a9d75622a9

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2022 00:36

Target

1940-60-0x0000000000930000-0x000000000095A000-memory.dll
Size

168KB
MD5

5feed9285bfd8e165ff2e68ff0b109fc
SHA1

f9b232c4b0f7030cd810ed16e6d2e7a29045acfe
SHA256

33dcd71f19c78e6f8912f191d7c797c735ef719c34847d70455094a9d75622a9
SHA512

3a339604c237c2c4fd7a3776cd52cec2ae8f40899cce8917af601ed00fb93113bcd5b435c87036ae4062b532ee3b2aab33921b85ea0987d8c933ba8cc3d70c88
SSDEEP

3072:O4+3EYn4daxwQf2lCoWUiLAh4Jz99ksTBf1cva83c3O/ya:3Y4dA7+ZWUic+Jx9ksTBNn83ce/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4932 4320 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4932	4320	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4368 wrote to memory of 4320	4368	rundll32.exe	rundll32.exe
PID 4368 wrote to memory of 4320	4368	rundll32.exe	rundll32.exe
PID 4368 wrote to memory of 4320	4368	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1940-60-0x0000000000930000-0x000000000095A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1940-60-0x0000000000930000-0x000000000095A000-memory.dll,#1
  2⤵
  PID:4320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 560
    3⤵
    - Program crash
    PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4320 -ip 4320
1⤵
PID:5044