a19e9c82850b8383852e8783a28a6e6a0abf8e221505b2bc2b42290192f3f58c

Analysis

max time kernel
242s
max time network
262s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 07:55

Target

a19e9c82850b8383852e8783a28a6e6a0abf8e221505b2bc2b42290192f3f58c.dll
Size

171KB
MD5

a3db9a88a3862df24c0527a73e0303c4
SHA1

13cd97bb2928e8aab5f36429ba52446548792f30
SHA256

a19e9c82850b8383852e8783a28a6e6a0abf8e221505b2bc2b42290192f3f58c
SHA512

94b698a6a36553a2796f4c241006c01978b09cac81c2fef2ef4dba788e01759b424f57ce176631ece9382d3ff5eb882df77853a71b1e0535460b3c0536760d1d
SSDEEP

3072:p8/NbdCGRtFq1zkuPczNslVnv70dWg6YIKOGBgmMMmq0yiF5y:p8VlRK1Aal5KWg6+BgmMVFT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3984	4600	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 4600	444	rundll32.exe	80
PID 444 wrote to memory of 4600	444	rundll32.exe	80
PID 444 wrote to memory of 4600	444	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a19e9c82850b8383852e8783a28a6e6a0abf8e221505b2bc2b42290192f3f58c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a19e9c82850b8383852e8783a28a6e6a0abf8e221505b2bc2b42290192f3f58c.dll,#1
  2⤵
  PID:4600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 540
    3⤵
    - Program crash
    PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4600 -ip 4600
1⤵
PID:2376

memory/4600-132-0x0000000000000000-mapping.dmp

Download
memory/4600-133-0x0000000001240000-0x0000000001259000-memory.dmp

Filesize
100KB

Download