6393d6dee287edf4a8e6549b8da1edcac67f2e5a8523a9dde4abb50d0478f92e

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:05

Target

6393d6dee287edf4a8e6549b8da1edcac67f2e5a8523a9dde4abb50d0478f92e.dll
Size

332KB
MD5

3e44f9d9f61d0c0e79558aeaebda1ed5
SHA1

8076dc7ea459880393d25b980796e03c7453c508
SHA256

6393d6dee287edf4a8e6549b8da1edcac67f2e5a8523a9dde4abb50d0478f92e
SHA512

f11864aa0923158000b375692ff5ce3698aa7f3e169892433570a46675dfe4f7e70d8d07bbc9c2283c60e5a842c440e6ebf10d8ad9da381d682319a1afd60141
SSDEEP

6144:jM84jI4d4eDp0dWk4nDWgRAkP+5S2GQn8xID0DMFxtTEgxK3r7IKNb3yMo:Y/k4d4eomR3P+s2GLxe0DStIgx4rEKNM

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4704 1724 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4704	1724	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4208 wrote to memory of 1724	4208	rundll32.exe	rundll32.exe
PID 4208 wrote to memory of 1724	4208	rundll32.exe	rundll32.exe
PID 4208 wrote to memory of 1724	4208	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6393d6dee287edf4a8e6549b8da1edcac67f2e5a8523a9dde4abb50d0478f92e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4208

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6393d6dee287edf4a8e6549b8da1edcac67f2e5a8523a9dde4abb50d0478f92e.dll,#1
2⤵
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 644
3⤵
- Program crash
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1724 -ip 1724
1⤵
PID:3632

memory/1724-132-0x0000000000000000-mapping.dmp

Download
memory/1724-133-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1724-134-0x0000000000A80000-0x0000000000AC0000-memory.dmp

Filesize
256KB

Download
memory/1724-135-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1724-136-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1724-137-0x0000000002580000-0x0000000002670000-memory.dmp

Filesize
960KB

Download
memory/1724-138-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1724-139-0x0000000002780000-0x0000000002920000-memory.dmp

Filesize
1.6MB

Download
memory/1724-140-0x0000000000AD0000-0x0000000000B4A000-memory.dmp

Filesize
488KB

Download
memory/1724-141-0x0000000000B90000-0x0000000000C26000-memory.dmp

Filesize
600KB

Download
memory/1724-142-0x0000000000A80000-0x0000000000AC0000-memory.dmp

Filesize
256KB

Download