754960fc2d3083a75f1b18e0fbac20b69018753673150e7e9b5323fe4058e143

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:51

Target

754960fc2d3083a75f1b18e0fbac20b69018753673150e7e9b5323fe4058e143.dll
Size

10KB
MD5

5250f0e64dd7154e24e5ba97cf72b08e
SHA1

dc9d19f58f29482294bef21715eb6cd0ca7bd217
SHA256

754960fc2d3083a75f1b18e0fbac20b69018753673150e7e9b5323fe4058e143
SHA512

126c669e314dc7f89d19841f8571f12774ed12c328f8764d8df5ac589a49580c7e8fdec1f16eaaf2b99e1ae76161f59c4074f8b4a3fd21ff9e816a18947694a0
SSDEEP

192:Fw8dHabRDEgtHyl0NSypWak6HVdW3yWak8QjdW3w9wv:ndHad/N20IypWak8dWiWak8EdWN

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2264 4656 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2264	4656	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4756 wrote to memory of 4656	4756	rundll32.exe	rundll32.exe
PID 4756 wrote to memory of 4656	4756	rundll32.exe	rundll32.exe
PID 4756 wrote to memory of 4656	4756	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\754960fc2d3083a75f1b18e0fbac20b69018753673150e7e9b5323fe4058e143.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\754960fc2d3083a75f1b18e0fbac20b69018753673150e7e9b5323fe4058e143.dll,#1
  2⤵
  PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 544
    3⤵
    - Program crash
    PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4656 -ip 4656
1⤵
PID:4408

memory/4656-132-0x0000000000000000-mapping.dmp

Download
memory/4656-133-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download
memory/4656-134-0x000000006DD20000-0x000000006DD27000-memory.dmp

Filesize
28KB

Download