6dc559b9804edccdb72a60618d9f58b4cc67f402f694d8e5f138764cf0a31ff7

Analysis

max time kernel
111s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:02

Target

6dc559b9804edccdb72a60618d9f58b4cc67f402f694d8e5f138764cf0a31ff7.dll
Size

362KB
MD5

15e7f63b53997c790024ce074a926a7b
SHA1

236eade542c7a2c3e0410bb563b2660db338ed6f
SHA256

6dc559b9804edccdb72a60618d9f58b4cc67f402f694d8e5f138764cf0a31ff7
SHA512

08e4bf59f2fbed98a393c3474d3e0ee22efc54e4e15ff934cddbead376826858394222f3f8376d68918672ccc0c81efc60ddf54d755f338ffcb2153f44efb7bb
SSDEEP

6144:OwM3I4nEYs2WLZzzPGGISkraoIX4NRZLLd/BZpymJZBS+tSfEwv5wyQ:xkI4nJsRzzPGGjkrgoN9Ppymfkn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1032 4388 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1032	4388	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4952 wrote to memory of 4388	4952	rundll32.exe	rundll32.exe
PID 4952 wrote to memory of 4388	4952	rundll32.exe	rundll32.exe
PID 4952 wrote to memory of 4388	4952	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6dc559b9804edccdb72a60618d9f58b4cc67f402f694d8e5f138764cf0a31ff7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6dc559b9804edccdb72a60618d9f58b4cc67f402f694d8e5f138764cf0a31ff7.dll,#1
  2⤵
  PID:4388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 596
    3⤵
    - Program crash
    PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4388 -ip 4388
1⤵
PID:3064

memory/4388-132-0x0000000000000000-mapping.dmp

Download
memory/4388-133-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download