c1348b346dcf5b37ab6d031c912268bb2b81ee6083de79141593441f3bf6a69b

Analysis

max time kernel
147s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 02:43

Target

c1348b346dcf5b37ab6d031c912268bb2b81ee6083de79141593441f3bf6a69b.dll
Size

42KB
MD5

798d60143b9d712673124aa8bdecaf41
SHA1

d782169d456fb01ed4bb07ad934ac8c19a465959
SHA256

c1348b346dcf5b37ab6d031c912268bb2b81ee6083de79141593441f3bf6a69b
SHA512

724b713419c23caaf1834c2ee23e2c1c406cc8f767f9cc0069a0e5b219c7f1a896d45826872483b24858b241ad471f93e3810a89b3da585b145a2dba8f410c27
SSDEEP

768:xpak22QZgmP26TTOTjqI8OcVbPo5e7rb5PyBL1o9gAia:xpa3go262Tj5coSrbgboeAi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1408	3312	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 3312	3512	rundll32.exe	79
PID 3512 wrote to memory of 3312	3512	rundll32.exe	79
PID 3512 wrote to memory of 3312	3512	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1348b346dcf5b37ab6d031c912268bb2b81ee6083de79141593441f3bf6a69b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1348b346dcf5b37ab6d031c912268bb2b81ee6083de79141593441f3bf6a69b.dll,#1
  2⤵
  PID:3312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 848
    3⤵
    - Program crash
    PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3312 -ip 3312
1⤵
PID:3160

memory/3312-133-0x0000000002050000-0x0000000002126000-memory.dmp

Filesize
856KB

Download
memory/3312-134-0x0000000002050000-0x0000000002126000-memory.dmp

Filesize
856KB

Download