ec173466aa78f728cbe9af8d982e251096f80eb81f7f35a577b582a6321c1802

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:47

Target

ec173466aa78f728cbe9af8d982e251096f80eb81f7f35a577b582a6321c1802.dll
Size

126KB
MD5

38740f3503fa016efd52c3972825de46
SHA1

2d6b390597a1d140144169d98985dc078c6c36cd
SHA256

ec173466aa78f728cbe9af8d982e251096f80eb81f7f35a577b582a6321c1802
SHA512

4954c507f5256575e483076edb08dd30cef465e4f0908a0c9d27ca1fface8caae2f3a5a3a394e27f33b9396d7fb7bf67a31b4db78bfb3dc6e802c49530f13ace
SSDEEP

1536:wyI7cejgyB8H1WNWts2093DRpQrT954SVvNIIxifw6c/tnleRZrJ5im7lw:pI7cyu1W13DkxpvNII0f8/RyrJXq

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3176 4832 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3176	4832	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4936 wrote to memory of 4832	4936	rundll32.exe	rundll32.exe
PID 4936 wrote to memory of 4832	4936	rundll32.exe	rundll32.exe
PID 4936 wrote to memory of 4832	4936	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec173466aa78f728cbe9af8d982e251096f80eb81f7f35a577b582a6321c1802.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec173466aa78f728cbe9af8d982e251096f80eb81f7f35a577b582a6321c1802.dll,#1
2⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 612
3⤵
- Program crash
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4832 -ip 4832
1⤵
PID:4976

memory/4832-135-0x0000000000000000-mapping.dmp

Download
memory/4832-136-0x0000000000C50000-0x0000000000C60000-memory.dmp

Filesize
64KB

Download
memory/4832-137-0x0000000000C90000-0x0000000000CB2000-memory.dmp

Filesize
136KB

Download
memory/4832-141-0x0000000010000000-0x0000000010022000-memory.dmp

Filesize
136KB

Download
memory/4832-142-0x0000000000C50000-0x0000000000C60000-memory.dmp

Filesize
64KB

Download