a077d851f869de84ca464d5933130da0b8522e6d18c5013c8ef9afe8e8dfff97

Analysis

max time kernel
91s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 00:18

Target

a077d851f869de84ca464d5933130da0b8522e6d18c5013c8ef9afe8e8dfff97.dll
Size

324KB
MD5

894a38a56f92729f9a3c53c8387c6690
SHA1

73db94536b5f3b3a8d83d0c5be70b62fb8ba739f
SHA256

a077d851f869de84ca464d5933130da0b8522e6d18c5013c8ef9afe8e8dfff97
SHA512

31b240f9d862db333369fb7cb0abe55427ec59f6b0403a76eafc5194b4aa8b8f1eda2891362409a5d8d7e530c039d77df33fd4928582de5eab9896eba479e675
SSDEEP

6144:d66u0YiGrU0Fm9NQzDekG58KO6DwHBR4ODrwIAAC0uDs:d6qYiGFIKvE+6D+1MI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5036	1808	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 1808	2328	rundll32.exe	81
PID 2328 wrote to memory of 1808	2328	rundll32.exe	81
PID 2328 wrote to memory of 1808	2328	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a077d851f869de84ca464d5933130da0b8522e6d18c5013c8ef9afe8e8dfff97.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a077d851f869de84ca464d5933130da0b8522e6d18c5013c8ef9afe8e8dfff97.dll,#1
  2⤵
  PID:1808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 664
    3⤵
    - Program crash
    PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1808 -ip 1808
1⤵
PID:2316

memory/1808-133-0x0000000001300000-0x0000000001351000-memory.dmp

Filesize
324KB

Download
memory/1808-137-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/1808-138-0x00000000012C0000-0x00000000012F8000-memory.dmp

Filesize
224KB

Download