d4b5e560d9af821642e4365193585aefcc03152e66b6d5060599f9335fccf7e9

Analysis

max time kernel
331s
max time network
372s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 12:24

Target

d4b5e560d9af821642e4365193585aefcc03152e66b6d5060599f9335fccf7e9.dll
Size

158KB
MD5

b38c36a4e4ffb898fcb400e529c235c2
SHA1

952c0377c4af0776b2726321b110969699ae937d
SHA256

d4b5e560d9af821642e4365193585aefcc03152e66b6d5060599f9335fccf7e9
SHA512

aeedf53a416e867497bcca25863211d25af2b1bb247af1313972eed818c9efde40a14a16fd4c8b2c1dc596d92fe9f771ad474ffc30154754f8b5b2b731271476
SSDEEP

1536:QgLIMoIVIJkuvfZ/Auw6sUB8BuegomYT/zkwqiQjvesIyX6+a8oO2Er5PpIHKKnX:QcKiyxvfGFueKETqiQ7hDRBGKK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1600	2792	WerFault.exe	78

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2792	1628	rundll32.exe	78
PID 1628 wrote to memory of 2792	1628	rundll32.exe	78
PID 1628 wrote to memory of 2792	1628	rundll32.exe	78
PID 2792 wrote to memory of 1600	2792	rundll32.exe	83
PID 2792 wrote to memory of 1600	2792	rundll32.exe	83
PID 2792 wrote to memory of 1600	2792	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4b5e560d9af821642e4365193585aefcc03152e66b6d5060599f9335fccf7e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4b5e560d9af821642e4365193585aefcc03152e66b6d5060599f9335fccf7e9.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 644
    3⤵
    - Program crash
    PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2792 -ip 2792
1⤵
PID:376

memory/2792-133-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download