4d093143cab7ca2c0a9f918ff82c423fe525ba79baeeb34d7b7968e466bac8b7

Analysis

max time kernel
192s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 14:35

Target

4d093143cab7ca2c0a9f918ff82c423fe525ba79baeeb34d7b7968e466bac8b7.dll
Size

529KB
MD5

9e4fe2bd53ace8133095f2df89de3c30
SHA1

cab07130a40bd15bbc7a12434da645b2e36908a9
SHA256

4d093143cab7ca2c0a9f918ff82c423fe525ba79baeeb34d7b7968e466bac8b7
SHA512

4790ba735f65254662776727c3b3f0e611656de6dc983e608870502fc40cb2317b068c35585187501788907b434c0d597a30a32939722bc3f88ef1e69e557fe3
SSDEEP

6144:wk2ho+Jpv0U5Txr9Zt8zfuBZmcGwaBK0kojHzFlAvRUh6oTwigm3732sxe/BthlB:uh7nvbNrXt8LYZmx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1860	2336	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2336	2500	rundll32.exe	78
PID 2500 wrote to memory of 2336	2500	rundll32.exe	78
PID 2500 wrote to memory of 2336	2500	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d093143cab7ca2c0a9f918ff82c423fe525ba79baeeb34d7b7968e466bac8b7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d093143cab7ca2c0a9f918ff82c423fe525ba79baeeb34d7b7968e466bac8b7.dll,#1
  2⤵
  PID:2336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 588
    3⤵
    - Program crash
    PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2336 -ip 2336
1⤵
PID:4988

memory/2336-132-0x0000000000000000-mapping.dmp

Download
memory/2336-133-0x0000000074BD0000-0x0000000074C57000-memory.dmp

Filesize
540KB

Download