270d61c59216be8e81bdacb307c2368891da6c75b7f53735b84e0358e2120bfa

Analysis

max time kernel
169s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:51

Target

270d61c59216be8e81bdacb307c2368891da6c75b7f53735b84e0358e2120bfa.dll
Size

10KB
MD5

2dcca2c0cf48002c7cd0e5d0f2b864c2
SHA1

78badf5cc10f7d666bf684e497924d0805bb0e88
SHA256

270d61c59216be8e81bdacb307c2368891da6c75b7f53735b84e0358e2120bfa
SHA512

78feef3a06cbbce69ef5c31727111cdd1cd14c745a7e6d2d5d7d373bf87fd93d03e42cab2f6634a04ab8c9f14d78a7853424f89176b4bde62be1b332d8a794ff
SSDEEP

192:Fw8dHabRDEgtHyl0NSypWak6HVdW3yWak8QjdW3w9wv:ndHad/N20IypWak8dWiWak8EdWN

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2468 1040 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2468	1040	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1280 wrote to memory of 1040	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 1040	1280	rundll32.exe	rundll32.exe
PID 1280 wrote to memory of 1040	1280	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\270d61c59216be8e81bdacb307c2368891da6c75b7f53735b84e0358e2120bfa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\270d61c59216be8e81bdacb307c2368891da6c75b7f53735b84e0358e2120bfa.dll,#1
2⤵
PID:1040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 560
3⤵
- Program crash
PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1040 -ip 1040
1⤵
PID:2772

memory/1040-132-0x0000000000000000-mapping.dmp

Download
memory/1040-133-0x000000006DD21000-0x000000006DD23000-memory.dmp

Filesize
8KB

Download
memory/1040-134-0x000000006DD20000-0x000000006DD27000-memory.dmp

Filesize
28KB

Download