739131599711bc2f3ac880f39286d2b08fc5f9d6fe4014f1de9a51e321a6330b

Analysis

max time kernel
318s
max time network
346s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:31

Target

739131599711bc2f3ac880f39286d2b08fc5f9d6fe4014f1de9a51e321a6330b.dll
Size

207KB
MD5

ee8feb158b61e0244679be7e4c31e7ac
SHA1

52d96e93d27675d6650b1ef523a2dc092dd7cf83
SHA256

739131599711bc2f3ac880f39286d2b08fc5f9d6fe4014f1de9a51e321a6330b
SHA512

ad54ebf0b119d5ae9e80907acb5a0b948360ee0a51a6294890242ac9c5c6c90d27b2e7e2bde9403d38c66bd557a8b526208d2ecccfcd8b8f323deef0d383c723
SSDEEP

6144:2NwOyNckjSz61wejuiUtkrNSbB9T1jL5p:ocq6jjuiUtYNSbjlL5p

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3808	1636	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 1636	3240	rundll32.exe	81
PID 3240 wrote to memory of 1636	3240	rundll32.exe	81
PID 3240 wrote to memory of 1636	3240	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\739131599711bc2f3ac880f39286d2b08fc5f9d6fe4014f1de9a51e321a6330b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\739131599711bc2f3ac880f39286d2b08fc5f9d6fe4014f1de9a51e321a6330b.dll,#1
  2⤵
  PID:1636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 664
    3⤵
    - Program crash
    PID:3808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1636 -ip 1636
1⤵
PID:4264

memory/1636-133-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/1636-134-0x0000000002B30000-0x0000000002B35000-memory.dmp

Filesize
20KB

Download
memory/1636-135-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/1636-136-0x0000000002AF0000-0x0000000002B15000-memory.dmp

Filesize
148KB

Download
memory/1636-137-0x0000000002AF0000-0x0000000002B15000-memory.dmp

Filesize
148KB

Download