c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76

Analysis

max time kernel
134s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 18:13

Target

c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76.dll
Size

102KB
MD5

3983fe5a3da123b2fdf237908044b200
SHA1

2302ebd1ac8a30e5265ba1c06af20e6c31b3357d
SHA256

c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76
SHA512

891b526115ddc4a83822f18a91b00d9e4bc8781609e88774e6e791b474524b43fb8d8b9d95a31ea504cb66f6ccb93087bd1cee66284a2cd27c4e704d80b70742
SSDEEP

3072:KfEltY+UGznKyqoL0Rhx378GAjtN/CdwFR76Uzgr2s7c:YCaPybWxL1+era

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
460	1404	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1404	800	rundll32.exe	79
PID 800 wrote to memory of 1404	800	rundll32.exe	79
PID 800 wrote to memory of 1404	800	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2ac59e050a065bfff2b877c06b27cb0e63bc9127cbb578d94e350a606724b76.dll,#1
  2⤵
  PID:1404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 544
    3⤵
    - Program crash
    PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1404 -ip 1404
1⤵
PID:4304

memory/1404-133-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download