67a88bb81c7dd66dca9127129d64356a1b86a776e7ac3c3c3e3e6be624ce17f6

Analysis

max time kernel
179s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 08:20

Target

67a88bb81c7dd66dca9127129d64356a1b86a776e7ac3c3c3e3e6be624ce17f6.dll
Size

117KB
MD5

8b1d66c9cd331e48dbc78e2b14bd2b1c
SHA1

add089c35df29d2a2a96dd873cb91c371d46e4ee
SHA256

67a88bb81c7dd66dca9127129d64356a1b86a776e7ac3c3c3e3e6be624ce17f6
SHA512

89f9c74bb4c2751ff5c752ab8d29747ad102d0cda6c931b8bb0354ad4bfc303bbbfa4ae79d918113db3ec44766c304b7431ccfa7a05ba6203ac797e9e06f96e1
SSDEEP

3072:GwPEEYD8BHHk7MwVUKx48JctQM6HkjzVD9k1QvqZbjK:GwPEE5n8jnxzJctQM6HozVD9abj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2340	3224	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 3224	2164	rundll32.exe	83
PID 2164 wrote to memory of 3224	2164	rundll32.exe	83
PID 2164 wrote to memory of 3224	2164	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67a88bb81c7dd66dca9127129d64356a1b86a776e7ac3c3c3e3e6be624ce17f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\67a88bb81c7dd66dca9127129d64356a1b86a776e7ac3c3c3e3e6be624ce17f6.dll,#1
  2⤵
  PID:3224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 636
    3⤵
    - Program crash
    PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3224 -ip 3224
1⤵
PID:1780

memory/3224-133-0x0000000002DB0000-0x0000000002DBF000-memory.dmp

Filesize
60KB

Download
memory/3224-134-0x0000000002DD0000-0x0000000002DEF000-memory.dmp

Filesize
124KB

Download
memory/3224-138-0x0000000002DB0000-0x0000000002DBF000-memory.dmp

Filesize
60KB

Download
memory/3224-139-0x0000000002DB0000-0x0000000002DBF000-memory.dmp

Filesize
60KB

Download