95b815a149191020a5a97d149144d6acf441ac1d23a8d9efa60e8d1742b34352

Analysis

max time kernel
208s
max time network
231s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 21:39

Target

95b815a149191020a5a97d149144d6acf441ac1d23a8d9efa60e8d1742b34352.dll
Size

144KB
MD5

285a93d9e01bfbae678799f0f1167cbd
SHA1

4508349998697bba4876c3b1669673c741f5efa1
SHA256

95b815a149191020a5a97d149144d6acf441ac1d23a8d9efa60e8d1742b34352
SHA512

47e3268323e3c05b52314fe5bbdd57721f482bed8f0035f160266375122a8ccf83f801cac542bbfd24ace25ed8bed73c5f76294df3973b0f6cc4b28378d25562
SSDEEP

3072:nTa79msLLh6kz0kYwYuubVk7qVzXhp/rCoh:Ta7sYLokNYwXuk7qfp/rlh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4468	4724	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 4724	4448	rundll32.exe	81
PID 4448 wrote to memory of 4724	4448	rundll32.exe	81
PID 4448 wrote to memory of 4724	4448	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95b815a149191020a5a97d149144d6acf441ac1d23a8d9efa60e8d1742b34352.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\95b815a149191020a5a97d149144d6acf441ac1d23a8d9efa60e8d1742b34352.dll,#1
  2⤵
  PID:4724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 728
    3⤵
    - Program crash
    PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4724 -ip 4724
1⤵
PID:4300

memory/4724-133-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download