ddda2c030e3a67f61460cb90f1f71f11c63ed6ccef404325b9ec0f5ad3652b1a

Analysis

max time kernel
188s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 16:47

Target

ddda2c030e3a67f61460cb90f1f71f11c63ed6ccef404325b9ec0f5ad3652b1a.dll
Size

10KB
MD5

222f69a1671cd21f7e55e6255c2aa605
SHA1

bd9b89e496ff05f7dd1fb9cf8cf25c78642ae0a8
SHA256

ddda2c030e3a67f61460cb90f1f71f11c63ed6ccef404325b9ec0f5ad3652b1a
SHA512

dda2624c50e305b0077c9fe0033c73a64e73cabb0b22e32c8c12e0d0ae7ccb9278ff3718391861665eb6c9f62020f6d2978a8b1fc2f0b18c3f579c7e7106ed07
SSDEEP

192:EaGsVRdStUIhx8EqU4VRLwagAcUrgL0oKbAyFP2JzLNbxbvtpmzhwX:EaDVyUo2EqU+0looaAyF4Rbxjtp9X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3512	4452	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 4452	2360	rundll32.exe	82
PID 2360 wrote to memory of 4452	2360	rundll32.exe	82
PID 2360 wrote to memory of 4452	2360	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddda2c030e3a67f61460cb90f1f71f11c63ed6ccef404325b9ec0f5ad3652b1a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddda2c030e3a67f61460cb90f1f71f11c63ed6ccef404325b9ec0f5ad3652b1a.dll,#1
  2⤵
  PID:4452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 544
    3⤵
    - Program crash
    PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4452 -ip 4452
1⤵
PID:1372

memory/4452-133-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download