f818db211bdd5023143b71d2fbc6f58ed38f19c7e02e99eb019b4b93aec35359

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 00:59

Target

f818db211bdd5023143b71d2fbc6f58ed38f19c7e02e99eb019b4b93aec35359.dll
Size

23KB
MD5

dc9ca7acc7059eb0650b35d6ebb6dc42
SHA1

7ce96fd7c2dd234286dd6c69fdadceb8d4b57a8e
SHA256

f818db211bdd5023143b71d2fbc6f58ed38f19c7e02e99eb019b4b93aec35359
SHA512

4fd0a125c101561a423e8489a372c8c2aa5878886277166e8d68d7b55a2ffd106002f7664437cb2ee99cc4fd8870aa24a71419f3eec896451f9e4fe943840f46
SSDEEP

384:mrJoU4ggFkgOzVVaKnR9EFUSvDjKIpwIGa6lgdWxqrbZ10BX0V0TEJ4m6mQv1q0G:gJo/qgOpVlnQFN6ICgdWxegX08IfQv9E

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4456	3796	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 3796	3172	rundll32.exe	80
PID 3172 wrote to memory of 3796	3172	rundll32.exe	80
PID 3172 wrote to memory of 3796	3172	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f818db211bdd5023143b71d2fbc6f58ed38f19c7e02e99eb019b4b93aec35359.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f818db211bdd5023143b71d2fbc6f58ed38f19c7e02e99eb019b4b93aec35359.dll,#1
  2⤵
  PID:3796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 576
    3⤵
    - Program crash
    PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3796 -ip 3796
1⤵
PID:2124

memory/3796-133-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3796-134-0x00000000005D0000-0x00000000005E0000-memory.dmp

Filesize
64KB

Download
memory/3796-135-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3796-136-0x0000000002640000-0x0000000002671000-memory.dmp

Filesize
196KB

Download