c254b99462448d44350658139e2e69171d02f3d4ec866ca6c0101ef511e57f4d

Analysis

max time kernel
186s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 22:05

Target

c254b99462448d44350658139e2e69171d02f3d4ec866ca6c0101ef511e57f4d.dll
Size

118KB
MD5

44b99675eecbe567faf627dabfeb2170
SHA1

f163e1cb593be2dcc6b26f4dddf14ab78c489dff
SHA256

c254b99462448d44350658139e2e69171d02f3d4ec866ca6c0101ef511e57f4d
SHA512

18c28b793083a805762c8e2c220d86a8e58910ca29df7653a8e9da0639095940a7ad62ddfaa78e0ea9f1d02a8ab86b30d51549c063a6cac65a0b065de5ceb8a8
SSDEEP

3072:vdngK7aidAEMG3hjHZdri+z6gBSOHZIJ5idPidfmiRDmdZ:vh77liNAviS5ZUsi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4828	4304	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 4304	4380	rundll32.exe	81
PID 4380 wrote to memory of 4304	4380	rundll32.exe	81
PID 4380 wrote to memory of 4304	4380	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c254b99462448d44350658139e2e69171d02f3d4ec866ca6c0101ef511e57f4d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c254b99462448d44350658139e2e69171d02f3d4ec866ca6c0101ef511e57f4d.dll,#1
  2⤵
  PID:4304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 572
    3⤵
    - Program crash
    PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4304 -ip 4304
1⤵
PID:3412

memory/4304-133-0x0000000010000000-0x0000000010062000-memory.dmp

Filesize
392KB

Download