12ee86645798c450bffbaaf4f07c4a1fef1e5997c90b19ac324cd877714eb2a8

Analysis

max time kernel
147s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 19:01

Target

12ee86645798c450bffbaaf4f07c4a1fef1e5997c90b19ac324cd877714eb2a8.dll
Size

120KB
MD5

9fcc1b73813358d8f62d4b895fd6aaa0
SHA1

a425cebd0ee9836b02fbf99e4a96626281e00203
SHA256

12ee86645798c450bffbaaf4f07c4a1fef1e5997c90b19ac324cd877714eb2a8
SHA512

bc768f6aa61072046ddb48a7a3948ae3b8ae187477a6a3e013f96151e0a7402ca4e82bed3a2531f69d0edc0eaa0539bc4a81a695483cdf7a929eea6bc3efcd18
SSDEEP

1536:5GQwW3L2qhnER13r9bIKrTulhRzIwsbvNTfEp6tQEKNPHJazlw/TJXj0xcIwCLtj:5GQfER13JblrohRaWQwHAw/tj0KCpiU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4184	2276	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 2276	4832	rundll32.exe	81
PID 4832 wrote to memory of 2276	4832	rundll32.exe	81
PID 4832 wrote to memory of 2276	4832	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12ee86645798c450bffbaaf4f07c4a1fef1e5997c90b19ac324cd877714eb2a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12ee86645798c450bffbaaf4f07c4a1fef1e5997c90b19ac324cd877714eb2a8.dll,#1
  2⤵
  PID:2276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 560
    3⤵
    - Program crash
    PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2276 -ip 2276
1⤵
PID:1480

memory/2276-133-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download