615770f2785bf7a219b6fe7094fa67ca4bc0e96aeb18318d5c11d55ee3c9725f

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 00:30

Target

615770f2785bf7a219b6fe7094fa67ca4bc0e96aeb18318d5c11d55ee3c9725f.dll
Size

51KB
MD5

53fa3be5f62ee736cad39dac8ce64c3e
SHA1

4000ec35eae9f65d1fddbe605cf32ba54bf52db0
SHA256

615770f2785bf7a219b6fe7094fa67ca4bc0e96aeb18318d5c11d55ee3c9725f
SHA512

58c41890a6911ad6871a8ab9adffa77b61a79b949231043b9dfb88d8571d7965f142d68aa3512f9098c0ef235488c19e08de62047d71486d468cb170ea8a1bc4
SSDEEP

768:3jkOznPbKe/1FZrDVAquMj8wtLuhHvfTOOYAEVJFe53Ja:/bN3DVAXMj8w+DLRJa

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4324	4608	WerFault.exe	80
4720	4608	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 4608	4208	rundll32.exe	80
PID 4208 wrote to memory of 4608	4208	rundll32.exe	80
PID 4208 wrote to memory of 4608	4208	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\615770f2785bf7a219b6fe7094fa67ca4bc0e96aeb18318d5c11d55ee3c9725f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\615770f2785bf7a219b6fe7094fa67ca4bc0e96aeb18318d5c11d55ee3c9725f.dll,#1
  2⤵
  PID:4608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 363136
    3⤵
    - Program crash
    PID:4324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 572
    3⤵
    - Program crash
    PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4608 -ip 4608
1⤵
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4608 -ip 4608
1⤵
PID:4756

memory/4608-133-0x0000000000400000-0x00000000004D6000-memory.dmp

Filesize
856KB

Download