84959656b42631f19c22168816fe267589d1b0514f1be83ae33c292514232f2b

Analysis

max time kernel
232s
max time network
316s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 19:44

Target

84959656b42631f19c22168816fe267589d1b0514f1be83ae33c292514232f2b.dll
Size

9KB
MD5

efacb93e0e48b04c09972946e88863f3
SHA1

8f7da454d4d62ed7fb6e781d05e4c88a1eba0796
SHA256

84959656b42631f19c22168816fe267589d1b0514f1be83ae33c292514232f2b
SHA512

41ab221aa9a8b14a66cc6f1acf913d7535f696b4b65cf9af478a16c204c7b08d32412f92b2a8cd468a90fc60651226525cc10bf5a147131f56e3c3668422b347
SSDEEP

96:qJV7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG3Sv:wuwEt8rsTUtPLzKNWSYWFSv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1340	1084	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 1084	3920	rundll32.exe	81
PID 3920 wrote to memory of 1084	3920	rundll32.exe	81
PID 3920 wrote to memory of 1084	3920	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84959656b42631f19c22168816fe267589d1b0514f1be83ae33c292514232f2b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\84959656b42631f19c22168816fe267589d1b0514f1be83ae33c292514232f2b.dll,#1
  2⤵
  PID:1084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 580
    3⤵
    - Program crash
    PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1084 -ip 1084
1⤵
PID:4904

memory/1084-133-0x00000000006E1000-0x00000000006E3000-memory.dmp

Filesize
8KB

Download
memory/1084-134-0x00000000006E1000-0x00000000006E3000-memory.dmp

Filesize
8KB

Download
memory/1084-135-0x00000000006E0000-0x00000000006E7000-memory.dmp

Filesize
28KB

Download