4872d3a9d14803bdea7d2177dc5cb1dade75622173355d0e75b20ea39aded90c

Analysis

max time kernel
148s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 05:23

Target

4872d3a9d14803bdea7d2177dc5cb1dade75622173355d0e75b20ea39aded90c.dll
Size

148KB
MD5

5b59ff57505b5762fbc540a041442b30
SHA1

587464d62f6632bd5b4e38127f84b959d401f068
SHA256

4872d3a9d14803bdea7d2177dc5cb1dade75622173355d0e75b20ea39aded90c
SHA512

1c084df6a4c279e4e845cf5339a4c82499dd9d1e047f03498af02135cbe345df26574f5beec882d115aeeeeee03bf161261a4161e2b022b59e13079e9e4c2df1
SSDEEP

1536:iKY7eTFA0D2nBQlh+nugebSToCEBEa6Bd7qGJSJmHO5Mp/oIyhD:i9CTPD2BQloukPEKa6Bd7q44yOg/khD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5112	3952	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 3952	2696	rundll32.exe	81
PID 2696 wrote to memory of 3952	2696	rundll32.exe	81
PID 2696 wrote to memory of 3952	2696	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4872d3a9d14803bdea7d2177dc5cb1dade75622173355d0e75b20ea39aded90c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4872d3a9d14803bdea7d2177dc5cb1dade75622173355d0e75b20ea39aded90c.dll,#1
  2⤵
  PID:3952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 572
    3⤵
    - Program crash
    PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3952 -ip 3952
1⤵
PID:4308

memory/3952-132-0x0000000000000000-mapping.dmp

Download
memory/3952-133-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download