9f54c8a8cb8912cdebad56778399f9da4ac7476600b03633e48051c3c2949a93

Analysis

max time kernel
151s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 15:27

Target

9f54c8a8cb8912cdebad56778399f9da4ac7476600b03633e48051c3c2949a93.dll
Size

144KB
MD5

943bb4bf948458b2288863d70ab9c0ce
SHA1

28836f734982006aa6d4b7c04ab0e11e53f16642
SHA256

9f54c8a8cb8912cdebad56778399f9da4ac7476600b03633e48051c3c2949a93
SHA512

d270a95be1c2aa4218fe50b4a30c43ee5ddf5b92597038c235a9653fa0a942da67676498e6a383fd5f9ad86368d099130ed018493e1f098e57f5be765ca54f68
SSDEEP

3072:k3ePjysQt03XXWZzuaOqFUu2GNzu5hfzRJobLnIs3Rl5j7XUeGs/SI0M:tPj2t0n2gqFUu20ehbRJ2739v

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
668	4376	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 4376	1316	rundll32.exe	84
PID 1316 wrote to memory of 4376	1316	rundll32.exe	84
PID 1316 wrote to memory of 4376	1316	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f54c8a8cb8912cdebad56778399f9da4ac7476600b03633e48051c3c2949a93.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f54c8a8cb8912cdebad56778399f9da4ac7476600b03633e48051c3c2949a93.dll,#1
  2⤵
  PID:4376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 876
    3⤵
    - Program crash
    PID:668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4376 -ip 4376
1⤵
PID:1056

memory/4376-133-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download
memory/4376-134-0x0000000001010000-0x0000000001030000-memory.dmp

Filesize
128KB

Download