dfcfdc26896887b88171734c149acb6bdc3ba8eeac7cd1ebcc413d591d64de16

Analysis

max time kernel
98s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 16:44

Target

dfcfdc26896887b88171734c149acb6bdc3ba8eeac7cd1ebcc413d591d64de16.dll
Size

281KB
MD5

6e4e12e9790d22817a607d2dae5b0667
SHA1

c47c6b4a73d0a9a811eb5b113241b70950e101b0
SHA256

dfcfdc26896887b88171734c149acb6bdc3ba8eeac7cd1ebcc413d591d64de16
SHA512

b6d8ac6d2f3e09d2815aa46ab4686e9a1ffc24166aeb9ec2637f504a06ede972017a6380b023e69fa397417015ce145346ab9e5f02377b1412de94553533e9fb
SSDEEP

6144:0pBqZFJCNGTO/G4T5mNTxV/vc5xJWoqE/YE3+mvNv8:0mw5T5mfMJ95YEOkNE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4824	1604	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 1604	4720	rundll32.exe	79
PID 4720 wrote to memory of 1604	4720	rundll32.exe	79
PID 4720 wrote to memory of 1604	4720	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfcfdc26896887b88171734c149acb6bdc3ba8eeac7cd1ebcc413d591d64de16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfcfdc26896887b88171734c149acb6bdc3ba8eeac7cd1ebcc413d591d64de16.dll,#1
  2⤵
  PID:1604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 676
    3⤵
    - Program crash
    PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1604 -ip 1604
1⤵
PID:4856

memory/1604-133-0x0000000000FA0000-0x0000000000FD3000-memory.dmp

Filesize
204KB

Download
memory/1604-134-0x00000000027A0000-0x00000000027EA000-memory.dmp

Filesize
296KB

Download
memory/1604-138-0x0000000000FA0000-0x0000000000FD3000-memory.dmp

Filesize
204KB

Download