545a98589ca4e2146f22b845ae670d056b7b87d14247fcd401a1b77a2c14f0a1

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:18

Target

545a98589ca4e2146f22b845ae670d056b7b87d14247fcd401a1b77a2c14f0a1.dll
Size

9KB
MD5

7ff05c8286ef8af9bd510432d0d7cee1
SHA1

170e33d229ae6be2c1a3fb233f8ee2e6cbf52b43
SHA256

545a98589ca4e2146f22b845ae670d056b7b87d14247fcd401a1b77a2c14f0a1
SHA512

eefd49e223b26a540ab813b673b946710aefb82aaa735bc0068d479b4a93c8055f207574754c4b0f6991955c1bc16d92cf8108e15bae4e19fd6e9cc1d7ca3b25
SSDEEP

192:ehBPIcgjqxL9DPezyiH4XCAVJPwHJTOHWxDhCRWQ:ehBgcgjqxL9jezZCCA+KB

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2408 2724 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2408	2724	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3880 wrote to memory of 2724	3880	rundll32.exe	rundll32.exe
PID 3880 wrote to memory of 2724	3880	rundll32.exe	rundll32.exe
PID 3880 wrote to memory of 2724	3880	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\545a98589ca4e2146f22b845ae670d056b7b87d14247fcd401a1b77a2c14f0a1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3880

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\545a98589ca4e2146f22b845ae670d056b7b87d14247fcd401a1b77a2c14f0a1.dll,#1
2⤵
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 620
3⤵
- Program crash
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2724 -ip 2724
1⤵
PID:4296

memory/2724-132-0x0000000000000000-mapping.dmp

Download
memory/2724-133-0x0000000000810000-0x0000000000814000-memory.dmp

Filesize
16KB

Download
memory/2724-134-0x0000000000810000-0x0000000000814000-memory.dmp

Filesize
16KB

Download