abd082a323d1645cd6398912148220c892700931ace8c6e0c1effc530648194c

Analysis

max time kernel
110s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 15:35

Target

abd082a323d1645cd6398912148220c892700931ace8c6e0c1effc530648194c.dll
Size

122KB
MD5

79f002797d01be1f60a59b1e5a3bbf4f
SHA1

9b7250cee146894a3630334d5dbb03c5f8ae73bd
SHA256

abd082a323d1645cd6398912148220c892700931ace8c6e0c1effc530648194c
SHA512

4f8d96326bd9e47f961f21dc5d4bd75ea31faece59d2c75c0a5f160bfac0e16581c912c40acb4a1565cbaa28cfe17fd923ae8336e320a48801dc352038e9b139
SSDEEP

3072:ynbJpEypKc+JjCc3Jcy006iSmmG/6icKdYlO1:IbJpd6GcOrmmi9cKd2O1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1196	4864	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4864	4772	rundll32.exe	81
PID 4772 wrote to memory of 4864	4772	rundll32.exe	81
PID 4772 wrote to memory of 4864	4772	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\abd082a323d1645cd6398912148220c892700931ace8c6e0c1effc530648194c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\abd082a323d1645cd6398912148220c892700931ace8c6e0c1effc530648194c.dll,#1
  2⤵
  PID:4864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 1040
    3⤵
    - Program crash
    PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4864 -ip 4864
1⤵
PID:4208

memory/4864-132-0x0000000000000000-mapping.dmp

Download
memory/4864-133-0x0000000000A30000-0x0000000000A52000-memory.dmp

Filesize
136KB

Download
memory/4864-134-0x0000000000A30000-0x0000000000A52000-memory.dmp

Filesize
136KB

Download
memory/4864-135-0x0000000000A30000-0x0000000000A52000-memory.dmp

Filesize
136KB

Download