f23dd7cce956f4c74a4fbdda65b2ef6d999349d52a19eefac8942a1f3c0090f5

Analysis

max time kernel
92s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 02:55

Target

f23dd7cce956f4c74a4fbdda65b2ef6d999349d52a19eefac8942a1f3c0090f5.dll
Size

103KB
MD5

82390f2a94cf82315a112bda856da746
SHA1

8c0c31233c6df75c5a61f8536d4a12c9ea0d87c1
SHA256

f23dd7cce956f4c74a4fbdda65b2ef6d999349d52a19eefac8942a1f3c0090f5
SHA512

a1f9f0641a316bb1a62bc2c475570158e841d5868b3da7b6dd5f36aa90d26d9de4bd83cf9ac404e4e5379342060e3d6a2cfda042f8a226244d6756c7ed21260a
SSDEEP

1536:rPjXQ3xawGfOcnJxn8Dvz4BjucXrKtDZ5:7jmIwFWJx8D0B+DZ5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2828	4960	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4960	4748	rundll32.exe	81
PID 4748 wrote to memory of 4960	4748	rundll32.exe	81
PID 4748 wrote to memory of 4960	4748	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f23dd7cce956f4c74a4fbdda65b2ef6d999349d52a19eefac8942a1f3c0090f5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f23dd7cce956f4c74a4fbdda65b2ef6d999349d52a19eefac8942a1f3c0090f5.dll,#1
  2⤵
  PID:4960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 548
    3⤵
    - Program crash
    PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4960 -ip 4960
1⤵
PID:4824

memory/4960-133-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download