e92a10b2683b23e7044254a7dbb23d41eb70bdcb709942f161676e0f3625fea5

Analysis

max time kernel
114s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 19:38

Target

e92a10b2683b23e7044254a7dbb23d41eb70bdcb709942f161676e0f3625fea5.dll
Size

6KB
MD5

47a8382e07d2d22137035e244683d7f3
SHA1

b6b40f4bb73e59520d23faa50e6095112a794563
SHA256

e92a10b2683b23e7044254a7dbb23d41eb70bdcb709942f161676e0f3625fea5
SHA512

914a86995fe00dafb2c312557c5e89627e7a7fee6b016df2b636447512bd2fd4238facd61fdd401181080266a490955ce8d371f3f26b72d3d1e9d7147ae83f5f
SSDEEP

96:Z1i56v4SjviH3GYbRBwAHnrA2yFdtH2wbHicTj0DL7w6OzFp:e5efjK3d3Hy2wbHicTj2nS

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5028	4064	WerFault.exe	78
1016	4064	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4064	4364	rundll32.exe	78
PID 4364 wrote to memory of 4064	4364	rundll32.exe	78
PID 4364 wrote to memory of 4064	4364	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e92a10b2683b23e7044254a7dbb23d41eb70bdcb709942f161676e0f3625fea5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e92a10b2683b23e7044254a7dbb23d41eb70bdcb709942f161676e0f3625fea5.dll,#1
  2⤵
  PID:4064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 568
    3⤵
    - Program crash
    PID:5028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 544
    3⤵
    - Program crash
    PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4064 -ip 4064
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4064 -ip 4064
1⤵
PID:4588

memory/4064-133-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download