8e772e10f43517716a33fb40a3a481e6e6fbdb3f81619efd0e2e13ef9e15030c

Analysis

max time kernel
203s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 01:30

Target

8e772e10f43517716a33fb40a3a481e6e6fbdb3f81619efd0e2e13ef9e15030c.dll
Size

115KB
MD5

8922047e485c81b2f3fc7f3abba13a82
SHA1

23e3a7d59e0726ed4c8a941c0443dfeed9bb0763
SHA256

8e772e10f43517716a33fb40a3a481e6e6fbdb3f81619efd0e2e13ef9e15030c
SHA512

f38e4477354c7aeb662ffa7f2892715f5a8c2bd3b267ce13d3015bd103f109252cd5d39f323066abb45fb99023b39b37d38c5bc4654089035c003011c4488bef
SSDEEP

3072:eGHgCKyE0g2VMqCgesdWrHahfnElTVZuw8j8/7:MCr023CgddYahfnqTVww8o/7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3132	2008	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 2008	384	rundll32.exe	82
PID 384 wrote to memory of 2008	384	rundll32.exe	82
PID 384 wrote to memory of 2008	384	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e772e10f43517716a33fb40a3a481e6e6fbdb3f81619efd0e2e13ef9e15030c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e772e10f43517716a33fb40a3a481e6e6fbdb3f81619efd0e2e13ef9e15030c.dll,#1
  2⤵
  PID:2008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 548
    3⤵
    - Program crash
    PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2008 -ip 2008
1⤵
PID:1064

memory/2008-132-0x0000000000000000-mapping.dmp

Download
memory/2008-133-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download