1534ab0400108fa4bb667d9d67c6e15fc623b026276322a23705aa8d6ff450f9

Analysis

max time kernel
235s
max time network
292s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 19:43

Target

1534ab0400108fa4bb667d9d67c6e15fc623b026276322a23705aa8d6ff450f9.dll
Size

264KB
MD5

e8d71d1643ec99e1232c14afc1f3e619
SHA1

624399bdb51a05c675743687d42f7cbee6deb075
SHA256

1534ab0400108fa4bb667d9d67c6e15fc623b026276322a23705aa8d6ff450f9
SHA512

dfa467cb00c9530ab2916e640ed16ce4325c4b9a4ded127c16765df406096ff2ea63980af705474d6ab762fb7238545fc63f9db17fd3c0d9b868a5d4df98012a
SSDEEP

3072:PLgbcGHrk8x7l/ADCImwDuo35xiaci3BVV2n8d77LDcwTB8lUYKZkyBEwXGo0iMW:soUkw7l/J0335MmPE8NHZV72sU1rs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3104	5072	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 5072	4544	rundll32.exe	81
PID 4544 wrote to memory of 5072	4544	rundll32.exe	81
PID 4544 wrote to memory of 5072	4544	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1534ab0400108fa4bb667d9d67c6e15fc623b026276322a23705aa8d6ff450f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1534ab0400108fa4bb667d9d67c6e15fc623b026276322a23705aa8d6ff450f9.dll,#1
  2⤵
  PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 652
    3⤵
    - Program crash
    PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5072 -ip 5072
1⤵
PID:2816

memory/5072-133-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download