7cbdb14d20c12277968051733117683d4f2a13cbcdfefe8bfdd6cc006a6c540d

Analysis

max time kernel
18s
max time network
3s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 06:28

Target

7cbdb14d20c12277968051733117683d4f2a13cbcdfefe8bfdd6cc006a6c540d.dll
Size

97KB
MD5

fc4ac4d1c3f9be96497ba000be2d2cfe
SHA1

29b60b2b703c36ac251d238a856375418ac91002
SHA256

7cbdb14d20c12277968051733117683d4f2a13cbcdfefe8bfdd6cc006a6c540d
SHA512

a9fcad750e134642107583e2f60d7f5ddf07405e972970df7be8d1c0cab806692b6dba2203deb5a13b0a1ddc08956c8f00920699e144407c3b1ca67302ca4e3f
SSDEEP

1536:c/4B/QnWkJk51cURjf8/CVvsJpEBXJ5EkxYdWMZbk7DfaopKaHjwki8:s4B/QWkJk51HRD8/CVsJpELhMZwXHjhJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2876	1752	WerFault.exe	75

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 1752	1152	rundll32.exe	75
PID 1152 wrote to memory of 1752	1152	rundll32.exe	75
PID 1152 wrote to memory of 1752	1152	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7cbdb14d20c12277968051733117683d4f2a13cbcdfefe8bfdd6cc006a6c540d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7cbdb14d20c12277968051733117683d4f2a13cbcdfefe8bfdd6cc006a6c540d.dll,#1
  2⤵
  PID:1752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 656
    3⤵
    - Program crash
    PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1752 -ip 1752
1⤵
PID:2656

memory/1752-133-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/1752-134-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download