034fbd462710af99f567580c44813c2ccfefb283f32660c2d25f8a472d9f2833

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 02:30

Target

034fbd462710af99f567580c44813c2ccfefb283f32660c2d25f8a472d9f2833.dll
Size

36KB
MD5

a7454f26c4533071f69ac6a28c1bdeea
SHA1

11e83da2c3c0a77f71b88048ce5ece7c89023934
SHA256

034fbd462710af99f567580c44813c2ccfefb283f32660c2d25f8a472d9f2833
SHA512

0c804edb811d2ed8e3f194a89dac06b868c58924fdaf7fc2c29ebe6a6ac597125ecdada9ecbf7380a9c5eb03c14ac3614de8066312e137cef5f96df8b43a11fa
SSDEEP

768:OpeBT5rLwuL5l+H4hIiaqUqnSt5+U/p7Q:UeBFr5l+H5iUYSt5+e0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2976	1392	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1392	2476	rundll32.exe	79
PID 2476 wrote to memory of 1392	2476	rundll32.exe	79
PID 2476 wrote to memory of 1392	2476	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\034fbd462710af99f567580c44813c2ccfefb283f32660c2d25f8a472d9f2833.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\034fbd462710af99f567580c44813c2ccfefb283f32660c2d25f8a472d9f2833.dll,#1
  2⤵
  PID:1392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 584
    3⤵
    - Program crash
    PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1392 -ip 1392
1⤵
PID:1668

memory/1392-133-0x0000000038000000-0x000000003800C000-memory.dmp

Filesize
48KB

Download