83b0778f2824a57e444586f5601ac9b3a21afc902d06218ca45a1825e7543552

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 22:12

Target

83b0778f2824a57e444586f5601ac9b3a21afc902d06218ca45a1825e7543552.dll
Size

385KB
MD5

5f56ddda5d5bba9ca0160d1494a509d8
SHA1

8e7c008de6076688aeb1009bf657e855262517f5
SHA256

83b0778f2824a57e444586f5601ac9b3a21afc902d06218ca45a1825e7543552
SHA512

269a04370cff6ab6e2ee31bc62a5275eb5d9a56f77cf3ea243669673cf1ff09cebe1ab1a5ec08abf09457c6624da8406003a68a9c89353bc2a61d882af08a327
SSDEEP

12288:JzVibTJEu+Q40dTInHYPm14b3XSqSdPsXj:JsJiB0ZIHJ14b3pSg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1636	4824	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4824	4848	rundll32.exe	18
PID 4848 wrote to memory of 4824	4848	rundll32.exe	18
PID 4848 wrote to memory of 4824	4848	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83b0778f2824a57e444586f5601ac9b3a21afc902d06218ca45a1825e7543552.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\83b0778f2824a57e444586f5601ac9b3a21afc902d06218ca45a1825e7543552.dll,#1
  2⤵
  PID:4824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 584
    3⤵
    - Program crash
    PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4824 -ip 4824
1⤵
PID:3644

memory/4824-133-0x0000000010000000-0x0000000010079000-memory.dmp

Filesize
484KB

Download