8a59f09591949cd325dbfa8e5993afe0d9d771d08c8f947f3193614c10a6dec1

Analysis

max time kernel
160s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 05:54

Target

8a59f09591949cd325dbfa8e5993afe0d9d771d08c8f947f3193614c10a6dec1.dll
Size

202KB
MD5

40456af836fa5d236bee367c11170ad3
SHA1

649087104d98317488c53f8636df3bc1f128d458
SHA256

8a59f09591949cd325dbfa8e5993afe0d9d771d08c8f947f3193614c10a6dec1
SHA512

ee7d675670f28508313d1e034548f2a1d413f4018cc9274032d97a790d5a7b091561e3afc6639bc67211343d61b2b1f5556331cf4544421627b15cb792eb1488
SSDEEP

6144:w+Tp0QytNZALThHudgOSNASZci7rjwf89je3X0:Pt0QNfhHudg/NASZP3wE9yH0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1836	1828	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 1828	2152	rundll32.exe	79
PID 2152 wrote to memory of 1828	2152	rundll32.exe	79
PID 2152 wrote to memory of 1828	2152	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a59f09591949cd325dbfa8e5993afe0d9d771d08c8f947f3193614c10a6dec1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a59f09591949cd325dbfa8e5993afe0d9d771d08c8f947f3193614c10a6dec1.dll,#1
  2⤵
  PID:1828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 612
    3⤵
    - Program crash
    PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1828 -ip 1828
1⤵
PID:460

memory/1828-132-0x0000000000000000-mapping.dmp

Download
memory/1828-133-0x0000000002640000-0x0000000002660000-memory.dmp

Filesize
128KB

Download