dd57c9d80ee108522b502804d1beb9121712c3e274eeb3817ad75065c63e6d5d

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 16:49

Target
dd57c9d80ee108522b502804d1beb9121712c3e274eeb3817ad75065c63e6d5d.dll
Size 581KB
Sample221201-vbpftacc9v
SHA256 dd57c9d80ee108522b502804d1beb9121712c3e274eeb3817ad75065c63e6d5d
MD5 a23e53950207a51c7a855234af2b2b0c
SHA1 668702f94beaac11bb1c306f85b1934727a73d62
SHA512 606bf5eb2649786586134d071b9ff8bd8cc2d70d2a70e42aa10338de7e0fe2299dcbd33ebf9ec53a5c8432fe2df5355f1c402f57c2fa7b881b63a964f2f6277d
SSDEEP 12288:mT8TrTr0rswieKcoFXJcyxR+8fbe4FY9a0PWP:u8Tnr0gF9coFXJBxd/Y9aL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4960	2332	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2332	1308	rundll32.exe	81
PID 1308 wrote to memory of 2332	1308	rundll32.exe	81
PID 1308 wrote to memory of 2332	1308	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd57c9d80ee108522b502804d1beb9121712c3e274eeb3817ad75065c63e6d5d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd57c9d80ee108522b502804d1beb9121712c3e274eeb3817ad75065c63e6d5d.dll,#1
  2⤵
  PID:2332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 624
    3⤵
    - Program crash
    PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2332 -ip 2332
1⤵
PID:4776

memory/2332-133-0x0000000000890000-0x0000000000924000-memory.dmp

Download

memory/2332-137-0x0000000000810000-0x000000000088C000-memory.dmp

Download