a88be1f4e5bd55e420d2fc9944cc222c27978c8bc24ba8475dd7d24726ec8f15

Analysis

max time kernel
90s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2022, 23:43

Target

a88be1f4e5bd55e420d2fc9944cc222c27978c8bc24ba8475dd7d24726ec8f15.dll
Size

6KB
MD5

d49457bd6936db5244a3f9567f3d58b0
SHA1

eeb6b1a34896ed28a130a5fba43706fcd0e69421
SHA256

a88be1f4e5bd55e420d2fc9944cc222c27978c8bc24ba8475dd7d24726ec8f15
SHA512

bb89ec574a515be27d3fa90c643b8a0d7d62426190f47c623cb903d0aa2e6fb8067392361197c2209850162f3cdea7e303ab8df020b381dc05c3e9b99535f58e
SSDEEP

192:f7I7HF0oa06Bz3SCoZoWlBcT5gilkb5vvE:f0LFo06Bzi21d9lOtE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4396	3080	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3080	2412	rundll32.exe	81
PID 2412 wrote to memory of 3080	2412	rundll32.exe	81
PID 2412 wrote to memory of 3080	2412	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a88be1f4e5bd55e420d2fc9944cc222c27978c8bc24ba8475dd7d24726ec8f15.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a88be1f4e5bd55e420d2fc9944cc222c27978c8bc24ba8475dd7d24726ec8f15.dll,#1
  2⤵
  PID:3080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 620
    3⤵
    - Program crash
    PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3080 -ip 3080
1⤵
PID:4492

memory/3080-133-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download