c90e67200667acb9152d06652e100f1c3de3baf935f6c7340d06703e6d63a491

Analysis

max time kernel
258s
max time network
317s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 05:46

Target

c90e67200667acb9152d06652e100f1c3de3baf935f6c7340d06703e6d63a491.dll
Size

86KB
MD5

7e2282393a0f8acc0e739284f1b7ac61
SHA1

594eb6b763344619ccef5c28d26a0698224e09be
SHA256

c90e67200667acb9152d06652e100f1c3de3baf935f6c7340d06703e6d63a491
SHA512

660c28893df4b097f8c42aa40fbb784c1eafac3f8fc618e07cc780ac74795e7ed13b6894f9dd9463640569710d64a883ed39bfce06a479a48d983186a69b38c1
SSDEEP

1536:Xl6gjDMVC1Ew5ZHSBbeBZXEif0THDPciweqfQy0rGBoGtXh316V:Xl6SDMlGHSBbAZcTDaeqoy0cp1m

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2848	2928	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2928	2520	rundll32.exe	80
PID 2520 wrote to memory of 2928	2520	rundll32.exe	80
PID 2520 wrote to memory of 2928	2520	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c90e67200667acb9152d06652e100f1c3de3baf935f6c7340d06703e6d63a491.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c90e67200667acb9152d06652e100f1c3de3baf935f6c7340d06703e6d63a491.dll,#1
  2⤵
  PID:2928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 660
    3⤵
    - Program crash
    PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2928 -ip 2928
1⤵
PID:2756

memory/2928-133-0x0000000010000000-0x0000000010074000-memory.dmp

Filesize
464KB

Download