1047704d0e321c282d9048011a2de84eb62b88e66c549359db5beb6f4e33bda1

Analysis

max time kernel
133s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 06:38

Target

1047704d0e321c282d9048011a2de84eb62b88e66c549359db5beb6f4e33bda1.dll
Size

581KB
MD5

32dafa0861a5fd13ad433261f98d3e70
SHA1

70f2fe56edef08a7ec694354ed0f08b116ee1ba2
SHA256

1047704d0e321c282d9048011a2de84eb62b88e66c549359db5beb6f4e33bda1
SHA512

067da04015b15cf65ae1880a501015ea58efc54e9514bb782bdfc80b2dc51381382fe7ff49065eef03749e311214be217deb74b9aa2a41b690ba486a3c5b8799
SSDEEP

12288:OBQtmeEEM8NktREWITID7nYRI0LeEdw+Rm:OBQttEV8OtR5kY7YRicVRm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4904	3052	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 3052	1476	rundll32.exe	79
PID 1476 wrote to memory of 3052	1476	rundll32.exe	79
PID 1476 wrote to memory of 3052	1476	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1047704d0e321c282d9048011a2de84eb62b88e66c549359db5beb6f4e33bda1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1047704d0e321c282d9048011a2de84eb62b88e66c549359db5beb6f4e33bda1.dll,#1
  2⤵
  PID:3052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 624
    3⤵
    - Program crash
    PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3052 -ip 3052
1⤵
PID:4708

memory/3052-133-0x0000000002A50000-0x0000000002AE5000-memory.dmp

Filesize
596KB

Download
memory/3052-137-0x0000000010000000-0x0000000010095000-memory.dmp

Filesize
596KB

Download
memory/3052-138-0x00000000029D0000-0x0000000002A4F000-memory.dmp

Filesize
508KB

Download