8b75b8cd12175efc656a973ca07446ee92e29e08454e7147933297831f28685e

Analysis

max time kernel
147s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 10:22

Target

8b75b8cd12175efc656a973ca07446ee92e29e08454e7147933297831f28685e.dll
Size

1.0MB
MD5

3852d0e97433ed4e9eb8360b20702d4c
SHA1

f433a951cec61a88b8fa9ba25b7cd85d533adf3e
SHA256

8b75b8cd12175efc656a973ca07446ee92e29e08454e7147933297831f28685e
SHA512

5f4409e4cbf2d41c431c60a23e568a7c2f5b0dba0cb405dd39721dcd40465ce538319a7d79a5b9b2d61b090bfac69236f42f0084ff885ab4c0f92ab12dfff210
SSDEEP

24576:uPQOOLIW5h/g4AFwYmKq9Er4q9W1f7XFpfUYeXzwhHNx:uIOOL/h/WmOrDW1DXFZnec9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4152	4908	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4908	5040	rundll32.exe	81
PID 5040 wrote to memory of 4908	5040	rundll32.exe	81
PID 5040 wrote to memory of 4908	5040	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b75b8cd12175efc656a973ca07446ee92e29e08454e7147933297831f28685e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b75b8cd12175efc656a973ca07446ee92e29e08454e7147933297831f28685e.dll,#1
  2⤵
  PID:4908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 620
    3⤵
    - Program crash
    PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4908 -ip 4908
1⤵
PID:224

memory/4908-133-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/4908-135-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/4908-134-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/4908-138-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download