28d6ca38d2775d0e3c54b0327ca9100a7a56e8ebbc5b5ec61249921af0cc6f35

Analysis

max time kernel
175s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 06:06

Target

28d6ca38d2775d0e3c54b0327ca9100a7a56e8ebbc5b5ec61249921af0cc6f35.dll
Size

376KB
MD5

fd08f0b2666336ba5c45d145ce2ec2f0
SHA1

ca979f503b452aa99e09cf4bdd0a036676a77ce3
SHA256

28d6ca38d2775d0e3c54b0327ca9100a7a56e8ebbc5b5ec61249921af0cc6f35
SHA512

bff1151d46fe34616f90a1e91570c673a079416c4b79c6452e536e7e30bc18438180f81b0f6bba2c8d8e686a26e2f512ac428ec9cdc696789c781e7c809f5325
SSDEEP

6144:3X96Jq6BMwYrKsQ5dm1LCCaeHGY0mOcWKyKYVSm6gctj060cQGIb79OHPRSVZsSC:3X6RrWlPakOuyK06bxsDHb7vVZs4mRWm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3612	1252	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 1252	1920	rundll32.exe	82
PID 1920 wrote to memory of 1252	1920	rundll32.exe	82
PID 1920 wrote to memory of 1252	1920	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28d6ca38d2775d0e3c54b0327ca9100a7a56e8ebbc5b5ec61249921af0cc6f35.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28d6ca38d2775d0e3c54b0327ca9100a7a56e8ebbc5b5ec61249921af0cc6f35.dll,#1
  2⤵
  PID:1252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 664
    3⤵
    - Program crash
    PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1252 -ip 1252
1⤵
PID:4648

memory/1252-132-0x0000000000000000-mapping.dmp

Download
memory/1252-133-0x0000000002E70000-0x0000000002EA7000-memory.dmp

Filesize
220KB

Download
memory/1252-134-0x0000000002EC0000-0x0000000002F1E000-memory.dmp

Filesize
376KB

Download
memory/1252-138-0x0000000002E70000-0x0000000002EA7000-memory.dmp

Filesize
220KB

Download