707236331dd764c6b2571ca051adf2e90366fd68cad9e97b1303d6a132dadca5

Analysis

max time kernel
184s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 22:58

Target

707236331dd764c6b2571ca051adf2e90366fd68cad9e97b1303d6a132dadca5.dll
Size

424KB
MD5

09a0feab1ed7e1bd617ecc55f3e0b480
SHA1

c20cf36ef6c6e05233c7b5e5109ead4a7e77bb3e
SHA256

707236331dd764c6b2571ca051adf2e90366fd68cad9e97b1303d6a132dadca5
SHA512

915ffc56a7d86a418796ba26b2399343c282faa9830089e10f9c2851559406f542e79831957d907091872c149c7addab2d0be742118aff25c6ba72526d24dc3e
SSDEEP

12288:gUstDD2SG7DAdGHgRfQOCXQFQOMFutYLBiFdN40:gUstuSG7DfKQTQFQOXGMF

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
112	2100	WerFault.exe	83
596	2100	WerFault.exe	83

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2100	4852	rundll32.exe	83
PID 4852 wrote to memory of 2100	4852	rundll32.exe	83
PID 4852 wrote to memory of 2100	4852	rundll32.exe	83
PID 2100 wrote to memory of 112	2100	rundll32.exe	85
PID 2100 wrote to memory of 112	2100	rundll32.exe	85
PID 2100 wrote to memory of 112	2100	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\707236331dd764c6b2571ca051adf2e90366fd68cad9e97b1303d6a132dadca5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\707236331dd764c6b2571ca051adf2e90366fd68cad9e97b1303d6a132dadca5.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 676
    3⤵
    - Program crash
    PID:112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 676
    3⤵
    - Program crash
    PID:596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2100 -ip 2100
1⤵
PID:1448

memory/112-138-0x0000000000000000-mapping.dmp

Download
memory/2100-132-0x0000000000000000-mapping.dmp

Download
memory/2100-133-0x0000000001F80000-0x0000000001FEA000-memory.dmp

Filesize
424KB

Download
memory/2100-137-0x0000000001F40000-0x0000000001F77000-memory.dmp

Filesize
220KB

Download