34921ee280c1cfa8b0056950cd42320145d95f366af9db4db4ed782f2bfc3928

Analysis

max time kernel
64s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:06

Target

34921ee280c1cfa8b0056950cd42320145d95f366af9db4db4ed782f2bfc3928.dll
Size

2.9MB
MD5

46ce1de3254ee1fc6d45108becaee08a
SHA1

104a05770088f4d3333ef2227fe3c051bb821cd5
SHA256

34921ee280c1cfa8b0056950cd42320145d95f366af9db4db4ed782f2bfc3928
SHA512

4105e944facbf8e701b2d66efc12ecd922c1cc5b28b7614ed2b716449b64504c742ab900a5cbb76ab2e60310f7cd6c43a5d8dea9488f91322b0560e112d7baad
SSDEEP

49152:YcLLWIDDzch+kqcpDXriQnH/FjVWRNK0miyb+WXFm5pTWJBRNRFH:lLLFcwkqcpDXri6ZWRoPiRT5dG7NR

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4900 2416 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4900	2416	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2012 wrote to memory of 2416	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2416	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2416	2012	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34921ee280c1cfa8b0056950cd42320145d95f366af9db4db4ed782f2bfc3928.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34921ee280c1cfa8b0056950cd42320145d95f366af9db4db4ed782f2bfc3928.dll,#1
2⤵
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 656
3⤵
- Program crash
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2416 -ip 2416
1⤵
PID:4796

memory/2416-132-0x0000000000000000-mapping.dmp

Download
memory/2416-133-0x0000000002670000-0x0000000002ED1000-memory.dmp

Filesize
8.4MB

Download
memory/2416-135-0x00000000009E0000-0x00000000009E6000-memory.dmp

Filesize
24KB

Download
memory/2416-134-0x0000000002670000-0x0000000002ED1000-memory.dmp

Filesize
8.4MB

Download
memory/2416-136-0x0000000002670000-0x0000000002ED1000-memory.dmp

Filesize
8.4MB

Download
memory/2416-137-0x00000000009E0000-0x00000000009E6000-memory.dmp

Filesize
24KB

Download