d088536871e40eb3f5c0e2891cf62a5c073d0a57e0929251c33438238e377629

Analysis

max time kernel
152s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 04:22

Target

d088536871e40eb3f5c0e2891cf62a5c073d0a57e0929251c33438238e377629.dll
Size

847KB
MD5

b8d2df91c9ba3a15daf2a490ac48b2f0
SHA1

9f74a8972af8734e504c00b50b3a30c45ad81ee7
SHA256

d088536871e40eb3f5c0e2891cf62a5c073d0a57e0929251c33438238e377629
SHA512

0499d7fe38fe96533380a15b1501a1f15cd5f55246495e36fee2ed3fecc09dec4d8c3eaba5175e332ebae6352e03bae43535a1a98ff96ee463eff0e7ea0601a4
SSDEEP

12288:uO1VzOsmEorDnmszvoAWDr9oQJlEsan6ov1qq22FrnoWD1wiQ5bIy+sCdH5bPjZy:uADEZvu6QJlfW641/XrnDYkNsCzr1y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	2296	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2296	1792	rundll32.exe	80
PID 1792 wrote to memory of 2296	1792	rundll32.exe	80
PID 1792 wrote to memory of 2296	1792	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d088536871e40eb3f5c0e2891cf62a5c073d0a57e0929251c33438238e377629.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d088536871e40eb3f5c0e2891cf62a5c073d0a57e0929251c33438238e377629.dll,#1
  2⤵
  PID:2296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 600
    3⤵
    - Program crash
    PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2296 -ip 2296
1⤵
PID:2040

memory/2296-133-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2296-134-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download