44624e009d92d8a1426de757355fb3428ad9e5972ac9e05e46777046858ab003

Analysis

max time kernel
135s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:50

Target

44624e009d92d8a1426de757355fb3428ad9e5972ac9e05e46777046858ab003.dll
Size

204KB
MD5

1670f783fc5bc7d5b5f38f0a17a71b08
SHA1

1c5bd36b21a7729b5de7e6ac43ae3d7b6f0006b7
SHA256

44624e009d92d8a1426de757355fb3428ad9e5972ac9e05e46777046858ab003
SHA512

dce76bd1f7eb20e78519f0aeee6a703953be67bfbbeeefb3db8433803ba0185553ff830f6d1a457921b4d5123fff07a166e2360b4c2aa6973ed011fa7ed4473d
SSDEEP

6144:FJNZKQMkmsRMYCrAenKhvRiDixaZP31uE:rNZftV2HrAeKhsu0Ph

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

728 3768 WerFault.exe rundll32.exe

pid	pid_target	process	target process
728	3768	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4720 wrote to memory of 3768	4720	rundll32.exe	rundll32.exe
PID 4720 wrote to memory of 3768	4720	rundll32.exe	rundll32.exe
PID 4720 wrote to memory of 3768	4720	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44624e009d92d8a1426de757355fb3428ad9e5972ac9e05e46777046858ab003.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44624e009d92d8a1426de757355fb3428ad9e5972ac9e05e46777046858ab003.dll,#1
  2⤵
  PID:3768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 620
    3⤵
    - Program crash
    PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3768 -ip 3768
1⤵
PID:4120

memory/3768-132-0x0000000000000000-mapping.dmp

Download
memory/3768-133-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/3768-134-0x0000000010000000-0x0000000010035000-memory.dmp

Filesize
212KB

Download
memory/3768-135-0x0000000002910000-0x0000000002934000-memory.dmp

Filesize
144KB

Download
memory/3768-136-0x0000000002910000-0x0000000002934000-memory.dmp

Filesize
144KB

Download