6fb2fcce4b265d3d52a59096ac8e0ee638e4b2616e19f887bd66abf3edccb9d3

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 10:22

Target

6fb2fcce4b265d3d52a59096ac8e0ee638e4b2616e19f887bd66abf3edccb9d3.dll
Size

43KB
MD5

3c6ea94cd0f25829c9d3ff84dee618a0
SHA1

a2f520e1a683eb29c8676492793b43ab7ed29ccb
SHA256

6fb2fcce4b265d3d52a59096ac8e0ee638e4b2616e19f887bd66abf3edccb9d3
SHA512

924b4ac8966cb984146623e5300ab35a50d2e70f4a2b1dd9dc400b28b3bd5ceacc8c1fea01c1625ba9e8a03596baf56d2a6cc28a90ee44bd18faedf965fdcda6
SSDEEP

768:n2GeiQ/jhqrTvfQK00f9F273BfuhWArf4YdIOtHuuoh11XOFUuSFUo:2GuVqAK00fMB4WAT5VuuO9K3+d

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
856	5068	WerFault.exe	32

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 5068	4032	rundll32.exe	32
PID 4032 wrote to memory of 5068	4032	rundll32.exe	32
PID 4032 wrote to memory of 5068	4032	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fb2fcce4b265d3d52a59096ac8e0ee638e4b2616e19f887bd66abf3edccb9d3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fb2fcce4b265d3d52a59096ac8e0ee638e4b2616e19f887bd66abf3edccb9d3.dll,#1
  2⤵
  PID:5068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 688
    3⤵
    - Program crash
    PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5068 -ip 5068
1⤵
PID:5040

memory/5068-133-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download