ba936b666f22cbffaa6e813bb456514710a937554412701d86e1d877e0edfc7b

Analysis

max time kernel
142s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 17:57

Target

ba936b666f22cbffaa6e813bb456514710a937554412701d86e1d877e0edfc7b.dll
Size

35KB
MD5

1160760cae180ae993e0fef27d61e24e
SHA1

8dae0ef760d44f14d94fff84038a021ce1820868
SHA256

ba936b666f22cbffaa6e813bb456514710a937554412701d86e1d877e0edfc7b
SHA512

0783d343ba78fa6b709e0ee81305aa9cad45a748877281b0590c378c242a6793267e7054165aa5352d3b669823cfd99adfcad279ff1e8f95d9113cd804c3b13e
SSDEEP

768:QRO+QLt0iBCM0bG2PZg+FdI0FhT5mNu0ieky:Q0+qw+yZg+bXFsu0k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3896	2516	WerFault.exe	44

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2516	2484	rundll32.exe	44
PID 2484 wrote to memory of 2516	2484	rundll32.exe	44
PID 2484 wrote to memory of 2516	2484	rundll32.exe	44

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba936b666f22cbffaa6e813bb456514710a937554412701d86e1d877e0edfc7b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba936b666f22cbffaa6e813bb456514710a937554412701d86e1d877e0edfc7b.dll,#1
  2⤵
  PID:2516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 700
    3⤵
    - Program crash
    PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2516 -ip 2516
1⤵
PID:3836

memory/2516-133-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2516-134-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download