cb91af22759bbe0b8c5ad13c05ed3731051682364663564f0fa129e9d632fbab

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 20:00

Target

cb91af22759bbe0b8c5ad13c05ed3731051682364663564f0fa129e9d632fbab.dll
Size

160KB
MD5

467669bbf7787608b1757af239020a87
SHA1

ac57e01e911896e42c1314d41bde5863eb74f7d2
SHA256

cb91af22759bbe0b8c5ad13c05ed3731051682364663564f0fa129e9d632fbab
SHA512

fd8ec2c06a39947ff4fb87335674d70b0ee95fc9b31ee06802362b3c07501c023d14a3b76524d329a45ff0a5b0c04cacecef35d61f3f3b7493368c6c3231da20
SSDEEP

3072:ETYc2ldltF9jWW808wEptrTsDWUWbWBNLmNTqAXGCeSGgq/JLnXcqJt8A43IT:ETYc2ldltF9jWW84WNk9mNTrXGwGgqSy

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
456	3092	WerFault.exe	81
1396	3092	WerFault.exe	81

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 3092	4932	rundll32.exe	81
PID 4932 wrote to memory of 3092	4932	rundll32.exe	81
PID 4932 wrote to memory of 3092	4932	rundll32.exe	81
PID 3092 wrote to memory of 456	3092	rundll32.exe	84
PID 3092 wrote to memory of 456	3092	rundll32.exe	84
PID 3092 wrote to memory of 456	3092	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb91af22759bbe0b8c5ad13c05ed3731051682364663564f0fa129e9d632fbab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb91af22759bbe0b8c5ad13c05ed3731051682364663564f0fa129e9d632fbab.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 624
    3⤵
    - Program crash
    PID:456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 624
    3⤵
    - Program crash
    PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3092 -ip 3092
1⤵
PID:2092

memory/3092-133-0x0000000075510000-0x0000000075550000-memory.dmp

Filesize
256KB

Download