05168947f8dc86cecb5079b638bf8eb4bc0b98137be8afc3f7a6140057bd8716

Analysis

max time kernel
183s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 11:09

Target

05168947f8dc86cecb5079b638bf8eb4bc0b98137be8afc3f7a6140057bd8716.dll
Size

572KB
MD5

b63c752884da47d27dba95aeae14c820
SHA1

3508770f85deadfd6e5d2b9e63a6d9c799a135cc
SHA256

05168947f8dc86cecb5079b638bf8eb4bc0b98137be8afc3f7a6140057bd8716
SHA512

82e65ec613c26e8b1d86c8c16dfc7ac5b3457eafbb509b7ced9cb403b628fb155b29978daae97730f4432a32e4c53e1fbb151278195deac242af4609f474d676
SSDEEP

6144:qz23eeijUDxUzZiIzMs9+9MG+YRWTuDAMA0waJRGi/YPcI+OU8CNaHTDHlYYZC8R:q9eiQFAzzMn93+IjY0wodZ1OfLraQI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4792	1340	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 1340	2820	rundll32.exe	80
PID 2820 wrote to memory of 1340	2820	rundll32.exe	80
PID 2820 wrote to memory of 1340	2820	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05168947f8dc86cecb5079b638bf8eb4bc0b98137be8afc3f7a6140057bd8716.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05168947f8dc86cecb5079b638bf8eb4bc0b98137be8afc3f7a6140057bd8716.dll,#1
  2⤵
  PID:1340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 612
    3⤵
    - Program crash
    PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1340 -ip 1340
1⤵
PID:4840

memory/1340-133-0x0000000002E00000-0x0000000002E8F000-memory.dmp

Filesize
572KB

Download
memory/1340-137-0x0000000002D80000-0x0000000002DFB000-memory.dmp

Filesize
492KB

Download