84615527f12a88f04a682a3e9bad2d68cd1cf3233c60a9bf4a1a530bcceb85a2

Analysis

max time kernel
133s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 06:39

Target

84615527f12a88f04a682a3e9bad2d68cd1cf3233c60a9bf4a1a530bcceb85a2.dll
Size

4KB
MD5

d47d7f49f399637a39e029ca74253468
SHA1

2973c68e7878210b9d9abc17c7b639f4dd6bf968
SHA256

84615527f12a88f04a682a3e9bad2d68cd1cf3233c60a9bf4a1a530bcceb85a2
SHA512

b0c27afda01bdc1b6bdef0848ac67572aeb72365d683333ff865ee749beb539a05c3c7116bec1d3ed777418e7234e921aae8efb2a1f42c7d5c40ae46fc980df6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
928	2748	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2748	1044	rundll32.exe	80
PID 1044 wrote to memory of 2748	1044	rundll32.exe	80
PID 1044 wrote to memory of 2748	1044	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84615527f12a88f04a682a3e9bad2d68cd1cf3233c60a9bf4a1a530bcceb85a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\84615527f12a88f04a682a3e9bad2d68cd1cf3233c60a9bf4a1a530bcceb85a2.dll,#1
  2⤵
  PID:2748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 612
    3⤵
    - Program crash
    PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2748 -ip 2748
1⤵
PID:4828

memory/2748-133-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download