f982f3c2c3bdd3471c0cfbab91e55c030cf2706623ec019a620475e154fb767a

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 15:57

Target

f982f3c2c3bdd3471c0cfbab91e55c030cf2706623ec019a620475e154fb767a.dll
Size

494KB
MD5

724aa1e114de94525386827dc4d522f9
SHA1

3b1778ad9caa97b7d16110ed85b17cd65575fc79
SHA256

f982f3c2c3bdd3471c0cfbab91e55c030cf2706623ec019a620475e154fb767a
SHA512

4e19a72bd8e2c896ed20b383190ecfb98b4d8db14d8831b7521a639fd71a146cc939b05b75707e090041db11f9e9a8890033b9806b45dea9c2c15bd444aea18e
SSDEEP

3072:+u8eu3PFf2YLOj745L4mqzz2v+lgadwkiAr/kPheI5N9fCmL:ovdfwkZ4Pzz2v+lxFahdh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4860	1496	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 1496	3996	rundll32.exe	79
PID 3996 wrote to memory of 1496	3996	rundll32.exe	79
PID 3996 wrote to memory of 1496	3996	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f982f3c2c3bdd3471c0cfbab91e55c030cf2706623ec019a620475e154fb767a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f982f3c2c3bdd3471c0cfbab91e55c030cf2706623ec019a620475e154fb767a.dll,#1
  2⤵
  PID:1496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 580
    3⤵
    - Program crash
    PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1496 -ip 1496
1⤵
PID:4620

memory/1496-133-0x00000000025E0000-0x0000000002600000-memory.dmp

Filesize
128KB

Download