80d477cd3d7a31b6162f5aad630f129faeb3dec5af6b7c360e15e28a0fa85e45

Analysis

max time kernel
200s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 13:08

Target

80d477cd3d7a31b6162f5aad630f129faeb3dec5af6b7c360e15e28a0fa85e45.dll
Size

119KB
MD5

6183062036e91b2fad07f06e44852ede
SHA1

a71bfcc486325886ac3e5c0eac90e6380f911a58
SHA256

80d477cd3d7a31b6162f5aad630f129faeb3dec5af6b7c360e15e28a0fa85e45
SHA512

c647ffc66eb65b6ad246eb696d4daca6ef3d37569682683de93df82860276f5cbf7717954c27672cc3b636dc18cdb17cf57ba7a2717fdd554006804fc9bd70ea
SSDEEP

3072:lozs8Yk8PLCiqiVlyCPZzJy5zAW71id31UlD4xpmPGPIYiRD2dZ:msH5VlyCzc+ccElDIZi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
228	624	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 624	4180	rundll32.exe	82
PID 4180 wrote to memory of 624	4180	rundll32.exe	82
PID 4180 wrote to memory of 624	4180	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80d477cd3d7a31b6162f5aad630f129faeb3dec5af6b7c360e15e28a0fa85e45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\80d477cd3d7a31b6162f5aad630f129faeb3dec5af6b7c360e15e28a0fa85e45.dll,#1
  2⤵
  PID:624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 572
    3⤵
    - Program crash
    PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 624 -ip 624
1⤵
PID:3908

memory/624-133-0x0000000010000000-0x0000000010068000-memory.dmp

Filesize
416KB

Download