9b6439a81b16285e942e50fc9106e6da3a5dd90b9ca5e65412cd6712bff7c246

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2022 03:58

Target

1664-66-0x0000000000080000-0x00000000000AA000-memory.dll
Size

168KB
MD5

2eb2bbddef69663c6c04b7fc306b4321
SHA1

f543b93f003b7c23519152a3dd7bf28b0e797d95
SHA256

9b6439a81b16285e942e50fc9106e6da3a5dd90b9ca5e65412cd6712bff7c246
SHA512

1b4bbd5ae444f005b9428a7bf9a34c66cd0d55873f032dc6fe5ff30b9de0be2f314d79e9ccdba5bc534178eb28782ddf82259c637942dd5a19197c33c60d783c
SSDEEP

3072:04maAlOqWHnlocPuJsq8A05J8aDsATBf5Lva83NrO/ya3:qOfHSWuJsqZQJJDsATBRW83N6/v

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4636 4712 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4636	4712	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4532 wrote to memory of 4712	4532	rundll32.exe	rundll32.exe
PID 4532 wrote to memory of 4712	4532	rundll32.exe	rundll32.exe
PID 4532 wrote to memory of 4712	4532	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1664-66-0x0000000000080000-0x00000000000AA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1664-66-0x0000000000080000-0x00000000000AA000-memory.dll,#1
  2⤵
  PID:4712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 564
    3⤵
    - Program crash
    PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4712 -ip 4712
1⤵
PID:4444