50d9ac2271629d805031fb62f3c59bf666b481fcf62db4416f564b9f651a2344

Analysis

max time kernel
175s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 12:42

Target

50d9ac2271629d805031fb62f3c59bf666b481fcf62db4416f564b9f651a2344.dll
Size

120KB
MD5

3cfd89cf58d53cf43a80269aeefe85a0
SHA1

663f63df30274fdcd2f17ec7e6780f6efb42352f
SHA256

50d9ac2271629d805031fb62f3c59bf666b481fcf62db4416f564b9f651a2344
SHA512

f72a91a7f45dda3e1bddc03a9bb126eae5e3ef4734c3cd3a58988066381ee9f97b3e4ca6a4c340b7a8c3ed046da2c9db9d6baa84bd4cc9699729ed3d7af4ad7e
SSDEEP

3072:ppynA6xKxvgm8gOxZY3iBGRTp35E5a0Llu1hZKIXE:pp2xtd1+6DwhZK2E

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4780	1808	WerFault.exe	78
4724	1808	WerFault.exe	78

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1808	2228	rundll32.exe	78
PID 2228 wrote to memory of 1808	2228	rundll32.exe	78
PID 2228 wrote to memory of 1808	2228	rundll32.exe	78
PID 1808 wrote to memory of 4780	1808	rundll32.exe	82
PID 1808 wrote to memory of 4780	1808	rundll32.exe	82
PID 1808 wrote to memory of 4780	1808	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50d9ac2271629d805031fb62f3c59bf666b481fcf62db4416f564b9f651a2344.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\50d9ac2271629d805031fb62f3c59bf666b481fcf62db4416f564b9f651a2344.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 560
    3⤵
    - Program crash
    PID:4780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 560
    3⤵
    - Program crash
    PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1808 -ip 1808
1⤵
PID:2128

memory/1808-133-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download