bae1be07637501a423204c8940f840d3d184038dd4ae4ba6dc0bc7970841f8cb

Analysis

max time kernel
261s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 05:30

Target

bae1be07637501a423204c8940f840d3d184038dd4ae4ba6dc0bc7970841f8cb.dll
Size

120KB
MD5

65b77d5d20576cb6f361130b2871fe00
SHA1

49a48864f7db3ae2de07206fda6612754a7b7241
SHA256

bae1be07637501a423204c8940f840d3d184038dd4ae4ba6dc0bc7970841f8cb
SHA512

1e6cc4e1d96a04f83f58eabb5b761ac35bee358d2bd3daf5858b6674c4266f95cdf41b197c9f2b18b357b0776f140b1d80b25cddbcd24e0c3113920674b4fe06
SSDEEP

3072:e3XPsMtJA+CNpWIscX4Ul6yv2Ii8LCZzDp0+pQR:e3XPCN4tr0Ti8s/3Y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1620	4252	WerFault.exe	82

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 4252	3352	rundll32.exe	82
PID 3352 wrote to memory of 4252	3352	rundll32.exe	82
PID 3352 wrote to memory of 4252	3352	rundll32.exe	82
PID 4252 wrote to memory of 1620	4252	rundll32.exe	85
PID 4252 wrote to memory of 1620	4252	rundll32.exe	85
PID 4252 wrote to memory of 1620	4252	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1be07637501a423204c8940f840d3d184038dd4ae4ba6dc0bc7970841f8cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1be07637501a423204c8940f840d3d184038dd4ae4ba6dc0bc7970841f8cb.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 560
    3⤵
    - Program crash
    PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4252 -ip 4252
1⤵
PID:4248

memory/4252-133-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download