b75831b7721cc8fe5a37d6028af8c14e51e70e2cc842caf3482cfa2f54248368

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 06:44

Target

b75831b7721cc8fe5a37d6028af8c14e51e70e2cc842caf3482cfa2f54248368.dll
Size

78KB
MD5

1fba592d8be65319405a5087815addc0
SHA1

398a25349c1fb36728d44bd7e67eb2bab74602ea
SHA256

b75831b7721cc8fe5a37d6028af8c14e51e70e2cc842caf3482cfa2f54248368
SHA512

e8353ab80f8107d4a5bd4a91cedf0c1bd33d17e8b8fffed2aa52644e188735fbf03cbb8ab775ad072f3b616cb9546d82fc180e0e682b2cac64a3226db6457ce3
SSDEEP

1536:V8arBRCfE0bfQXpcPFIr9JGy5o9ci3STJer0PPhy1AQHnCHSUNV/Kjuun4EuH:fn0bYX+yrpad3Sl6YPhyqlJA41H

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3788	2224	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2224	2268	rundll32.exe	80
PID 2268 wrote to memory of 2224	2268	rundll32.exe	80
PID 2268 wrote to memory of 2224	2268	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b75831b7721cc8fe5a37d6028af8c14e51e70e2cc842caf3482cfa2f54248368.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b75831b7721cc8fe5a37d6028af8c14e51e70e2cc842caf3482cfa2f54248368.dll,#1
  2⤵
  PID:2224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 620
    3⤵
    - Program crash
    PID:3788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2224 -ip 2224
1⤵
PID:2040

memory/2224-133-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download