d805c9cc29f34618819747c9ace515e0241328debd91f02a72b4930d0b377e5b

Analysis

max time kernel
178s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 20:00

Target

d805c9cc29f34618819747c9ace515e0241328debd91f02a72b4930d0b377e5b.dll
Size

295KB
MD5

c41b99014e9052ca081e88c185c00a20
SHA1

e7968dac575f658c4bef3dba99bbf88b65272d1a
SHA256

d805c9cc29f34618819747c9ace515e0241328debd91f02a72b4930d0b377e5b
SHA512

d8800929e37ed59be74c1ccba0251123be25140280518cdb3c7e8da143ef71689f1c44cab7ea9680b34bfd1ddf801241855adfb045b00d27635bc44990e530c6
SSDEEP

6144:qLaUUJgrHWFFvh+UFNpc73IqraP/hP/zBJ9cjhqKbF6bQ2wVp:qLaJ2WFFgzIq2P1z3qsKh6bdwp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4548	2260	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 2260	4316	rundll32.exe	82
PID 4316 wrote to memory of 2260	4316	rundll32.exe	82
PID 4316 wrote to memory of 2260	4316	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d805c9cc29f34618819747c9ace515e0241328debd91f02a72b4930d0b377e5b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d805c9cc29f34618819747c9ace515e0241328debd91f02a72b4930d0b377e5b.dll,#1
  2⤵
  PID:2260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 580
    3⤵
    - Program crash
    PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2260 -ip 2260
1⤵
PID:4244

memory/2260-133-0x0000000010000000-0x00000000100A2000-memory.dmp

Filesize
648KB

Download