b1cb6a68f6a199727b77d4567c0c4a54edce7378cf4f0cca023246d63ad90e64

Analysis

max time kernel
165s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 07:14

Target

b1cb6a68f6a199727b77d4567c0c4a54edce7378cf4f0cca023246d63ad90e64.dll
Size

3KB
MD5

7d45426c39b82ed1b5799846225a9284
SHA1

d1ee2170d66447df40544bdc7857de748c2b2694
SHA256

b1cb6a68f6a199727b77d4567c0c4a54edce7378cf4f0cca023246d63ad90e64
SHA512

c3fa63ab9b16ff57fa45399208b953653a4f0cfd85b4834d70a68d71bfc48279a816fc9a1f6094f49bff7f3ddf07dcd3bc8dda07da40e28096ad8efa36692819

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
884	2552	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2552	2340	rundll32.exe	84
PID 2340 wrote to memory of 2552	2340	rundll32.exe	84
PID 2340 wrote to memory of 2552	2340	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1cb6a68f6a199727b77d4567c0c4a54edce7378cf4f0cca023246d63ad90e64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b1cb6a68f6a199727b77d4567c0c4a54edce7378cf4f0cca023246d63ad90e64.dll,#1
  2⤵
  PID:2552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 564
    3⤵
    - Program crash
    PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2552 -ip 2552
1⤵
PID:2696

memory/2552-133-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download