0083c4e1703cfb4d776701eac4eb387d418e8db8febec74c19a0f1b29602b8ce

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 12:38

Target

1668-57-0x00000000001D0000-0x00000000001FA000-memory.dll
Size

168KB
MD5

482881d65a62dfd049351e08a3039fd0
SHA1

84daa55d8f07a7535786ebdb8fd3dc9a87334fa4
SHA256

0083c4e1703cfb4d776701eac4eb387d418e8db8febec74c19a0f1b29602b8ce
SHA512

23c2c2421ffe95ff581996165dd088d6b6ee2125b4a5b124420c0ff8ba2f387b2daa89db58c168de04c310452505bdcb1f822a98888d914fa539e5b58bbbd192
SSDEEP

3072:m42R1+j+XyOz+A2C+Q1AmJNbl/ATBfpyva832VO/ya:xj2/ajC+QGmJRl/ATBhR832E/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4024	2160	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2160	1952	rundll32.exe	84
PID 1952 wrote to memory of 2160	1952	rundll32.exe	84
PID 1952 wrote to memory of 2160	1952	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x00000000001D0000-0x00000000001FA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x00000000001D0000-0x00000000001FA000-memory.dll,#1
  2⤵
  PID:2160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 560
    3⤵
    - Program crash
    PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2160 -ip 2160
1⤵
PID:4448