f32ac928eff71bdc6d665932ae1fbc3e459a79ec5a0ff901baeb41d11d12f9d0

Analysis

max time kernel
148s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:21

Target

f32ac928eff71bdc6d665932ae1fbc3e459a79ec5a0ff901baeb41d11d12f9d0.dll
Size

1.8MB
MD5

96b45740576961087c259bfb430289c8
SHA1

73beab4f8da9660dc2a0ba5c1161ddc7c5f85011
SHA256

f32ac928eff71bdc6d665932ae1fbc3e459a79ec5a0ff901baeb41d11d12f9d0
SHA512

c4fe6ef4b0091a1e2bb959e894686e57203a1e2100f0ca0f3bf94b1a75541ce03106aca4aa8c6381830ea1d1e86be51670134078778e6b792ae33cf54cd4bd5d
SSDEEP

24576:igA3729AOae8cdO0jdhk5Ezq1CJDrwHb/IRTv78vvDu1fK9QFai:awAdeY0pho+q1sKIRTD8vcK9Ma

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
816	4944	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4944	4984	rundll32.exe	82
PID 4984 wrote to memory of 4944	4984	rundll32.exe	82
PID 4984 wrote to memory of 4944	4984	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f32ac928eff71bdc6d665932ae1fbc3e459a79ec5a0ff901baeb41d11d12f9d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f32ac928eff71bdc6d665932ae1fbc3e459a79ec5a0ff901baeb41d11d12f9d0.dll,#1
  2⤵
  PID:4944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 728
    3⤵
    - Program crash
    PID:816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4944 -ip 4944
1⤵
PID:4904

memory/4944-133-0x0000000010000000-0x00000000101C4000-memory.dmp

Filesize
1.8MB

Download
memory/4944-134-0x0000000002960000-0x000000000296D000-memory.dmp

Filesize
52KB

Download
memory/4944-135-0x0000000002970000-0x000000000297D000-memory.dmp

Filesize
52KB

Download
memory/4944-136-0x0000000002970000-0x000000000297D000-memory.dmp

Filesize
52KB

Download