76f524fdc4063cb1dd73605d9a3b158d8b97feab784d1c092ad7c2ab05ccf412

Analysis

max time kernel
112s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 03:06

Target

76f524fdc4063cb1dd73605d9a3b158d8b97feab784d1c092ad7c2ab05ccf412.dll
Size

56KB
MD5

889b414dda22c31ca0dc671fbbee7134
SHA1

b033e3e4600482b763e93c58a9cd189ed97b2114
SHA256

76f524fdc4063cb1dd73605d9a3b158d8b97feab784d1c092ad7c2ab05ccf412
SHA512

8897cad322f9cd1a5e457716c52f52efa66189cc7389ab2054303beeb8da09a1885a1d9b01d6eeb0f95307d5366fc164c67edd21217f1da6177d453af90ae548
SSDEEP

1536:uwoq+LsVXPTteJSWWRnGYNYnu3UCoZruSaaM6:hN+oVXvWqGk3UCGuQt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
936	764	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 764	1144	rundll32.exe	80
PID 1144 wrote to memory of 764	1144	rundll32.exe	80
PID 1144 wrote to memory of 764	1144	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76f524fdc4063cb1dd73605d9a3b158d8b97feab784d1c092ad7c2ab05ccf412.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76f524fdc4063cb1dd73605d9a3b158d8b97feab784d1c092ad7c2ab05ccf412.dll,#1
  2⤵
  PID:764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 548
    3⤵
    - Program crash
    PID:936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 764 -ip 764
1⤵
PID:2264

memory/764-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download