7aba1d2459008818cb1ea99b3833cf1b6997784ab84bf0a026f23bf0c25ad94f

Analysis

max time kernel
170s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 14:10

Target

7aba1d2459008818cb1ea99b3833cf1b6997784ab84bf0a026f23bf0c25ad94f.dll
Size

48KB
MD5

98995ef6dd059b1a97e8d92edc75f530
SHA1

17d8f5606858081fd6b0233d5a52126dd05b8d79
SHA256

7aba1d2459008818cb1ea99b3833cf1b6997784ab84bf0a026f23bf0c25ad94f
SHA512

c6f628eaf0b2bfee121357873b6324c87f8a848bff2cc78fbc819950f1c60b332f53f1e3619f6fa2127f20b29abe9379a298e9b2f9ea878483f4d3a9a6944e3a
SSDEEP

768:UJIGvAAZQhETQP44iAUrJFEBjiHIjho3wIa4VhMbIs9E7v4MLXBnkCvHvpX7CBue:UJI8Ac0AFMmL3wIrVmbIdDbRLvPpXIue

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5028	1108	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 1108	4076	rundll32.exe	84
PID 4076 wrote to memory of 1108	4076	rundll32.exe	84
PID 4076 wrote to memory of 1108	4076	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7aba1d2459008818cb1ea99b3833cf1b6997784ab84bf0a026f23bf0c25ad94f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7aba1d2459008818cb1ea99b3833cf1b6997784ab84bf0a026f23bf0c25ad94f.dll,#1
  2⤵
  PID:1108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 608
    3⤵
    - Program crash
    PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1108 -ip 1108
1⤵
PID:1072

memory/1108-132-0x0000000000000000-mapping.dmp

Download
memory/1108-133-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download