525db9405888c2dcab1921ec1fd5a9f5229085c5fc36e0bee936c9a019e6132a

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 17:02

Target

525db9405888c2dcab1921ec1fd5a9f5229085c5fc36e0bee936c9a019e6132a.dll
Size

172KB
MD5

d40d8e9f80405fe8566f6c9b3562a429
SHA1

7f0c26a7b22763850e13085e96599d51f9a50069
SHA256

525db9405888c2dcab1921ec1fd5a9f5229085c5fc36e0bee936c9a019e6132a
SHA512

77501d9586f0297508e45cd2821478650a1c77ecef0fcfcd507bbac71dc5ea78af79684e20c07be45bcd7838931ed81aded1abcf692070d05a7b9b4b338e5552
SSDEEP

3072:CQ6xHhPMlMpaJBN/tCyfrmCnAkeEDer8ysrs+MeffaE:CvjPUMpaJBdVfrm9hr+rsA3F

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1324	4920	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4920	4964	rundll32.exe	80
PID 4964 wrote to memory of 4920	4964	rundll32.exe	80
PID 4964 wrote to memory of 4920	4964	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\525db9405888c2dcab1921ec1fd5a9f5229085c5fc36e0bee936c9a019e6132a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\525db9405888c2dcab1921ec1fd5a9f5229085c5fc36e0bee936c9a019e6132a.dll,#1
  2⤵
  PID:4920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 540
    3⤵
    - Program crash
    PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4920 -ip 4920
1⤵
PID:4952

memory/4920-133-0x0000000002DA0000-0x0000000002DC2000-memory.dmp

Filesize
136KB

Download