bf3e83d8bb321c983e11ae9c4ef6e81c458c9e55a265a7bb59be7061d0f00a5a

Analysis

max time kernel
165s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 12:03

Target

bf3e83d8bb321c983e11ae9c4ef6e81c458c9e55a265a7bb59be7061d0f00a5a.dll
Size

1.1MB
MD5

916f38367c33e813e4142ad7e9ab5eb3
SHA1

fc9a352821dc9c66de07f0028a26f154bed409cb
SHA256

bf3e83d8bb321c983e11ae9c4ef6e81c458c9e55a265a7bb59be7061d0f00a5a
SHA512

a9079bf3eefef6af71a422b3cd8be1b56f88be71fab09d4ce975452d666f58a409f1027f9a4b18e8d2a68ebab345a885029332cb90ef2b6deaa7b8928a7bf17b
SSDEEP

12288:fo6sTsKlVWQSjW0EPrvoxkRWvKT4hSDgAqsNaGMvRs807cpgr2bJf1znPtKu6cc:foFVWQrboxkGSSsPIRs8/pgSbJfN8Oc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	1020	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 1020	3592	rundll32.exe	79
PID 3592 wrote to memory of 1020	3592	rundll32.exe	79
PID 3592 wrote to memory of 1020	3592	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf3e83d8bb321c983e11ae9c4ef6e81c458c9e55a265a7bb59be7061d0f00a5a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf3e83d8bb321c983e11ae9c4ef6e81c458c9e55a265a7bb59be7061d0f00a5a.dll,#1
  2⤵
  PID:1020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 592
    3⤵
    - Program crash
    PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1020 -ip 1020
1⤵
PID:1656

memory/1020-133-0x0000000010000000-0x0000000010117000-memory.dmp

Filesize
1.1MB

Download