a34629a376062b9569c04e96d2d9df28177cf5e8f98533d803c626e06cfd2c8f

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:23

Target
a34629a376062b9569c04e96d2d9df28177cf5e8f98533d803c626e06cfd2c8f.dll
Size 1.3MB
Sample221203-ng6tqaab7v
SHA256 a34629a376062b9569c04e96d2d9df28177cf5e8f98533d803c626e06cfd2c8f
MD5 eff7646f7c5385bf38cd228502936964
SHA1 0ddd2f7a40d99a1e5dee788e1ff81e6c91faf483
SHA512 38e69bcc7fa8f6b3677677de0692a5d4b14c0b428893255f0fccca42fc73198b9ba12dde2ced3b1824ee3d1c934f78bb2bdb47de41a7352e46d819484ac83f64
SSDEEP 6144:Nl1ZtZCr7P+5vEild+zE1D1pyCkVTgJTnTTDZ:v1ZDCv4xl8zE1DmCk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2880	1904	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1904	1488	rundll32.exe	78
PID 1488 wrote to memory of 1904	1488	rundll32.exe	78
PID 1488 wrote to memory of 1904	1488	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a34629a376062b9569c04e96d2d9df28177cf5e8f98533d803c626e06cfd2c8f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a34629a376062b9569c04e96d2d9df28177cf5e8f98533d803c626e06cfd2c8f.dll,#1
  2⤵
  PID:1904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 560
    3⤵
    - Program crash
    PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1904 -ip 1904
1⤵
PID:2804

memory/1904-133-0x0000000010000000-0x0000000010142000-memory.dmp

Download