973d78a6d47aa3852ddb86346bc0e6567c20cd3f0e1dc4cbde4ed38554075b6d

Analysis

max time kernel
264s
max time network
319s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 06:41

Target

973d78a6d47aa3852ddb86346bc0e6567c20cd3f0e1dc4cbde4ed38554075b6d.dll
Size

28KB
MD5

c177798308fd23b9ffb7ca4b1ec019ee
SHA1

5aafb208e316e5c6e6b42fa43c5786c082cd1889
SHA256

973d78a6d47aa3852ddb86346bc0e6567c20cd3f0e1dc4cbde4ed38554075b6d
SHA512

f1f4e0bb25b3c988da963e4abdab4ca8eb2ab5bcf2dc4b547e951b73945f22b52b70bc7abd7e026b7265b867502efdca464c55124aba3bbfd2c394b8fd328e9a
SSDEEP

768:ipHzBadNvMmsYrqIlDLhZjR676Msah+ngS84o+s0S+HMlQ5IMc:CBWNvMdHaDVZd67Vsah2gn4Q0S+HMlFb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4380	3728	WerFault.exe	84

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 3612	3196	rundll32.exe	81
PID 3196 wrote to memory of 3612	3196	rundll32.exe	81
PID 3196 wrote to memory of 3612	3196	rundll32.exe	81
PID 3612 wrote to memory of 3728	3612	rundll32.exe	84
PID 3612 wrote to memory of 3728	3612	rundll32.exe	84
PID 3612 wrote to memory of 3728	3612	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\973d78a6d47aa3852ddb86346bc0e6567c20cd3f0e1dc4cbde4ed38554075b6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\973d78a6d47aa3852ddb86346bc0e6567c20cd3f0e1dc4cbde4ed38554075b6d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\973d78a6d47aa3852ddb86346bc0e6567c20cd3f0e1dc4cbde4ed38554075b6d.dll,#1
    3⤵
    PID:3728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 544
      4⤵
      Program crash
      PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3728 -ip 3728
1⤵
PID:3080

memory/3612-134-0x00000000006C0000-0x00000000006ED000-memory.dmp

Filesize
180KB

Download
memory/3612-135-0x00000000006C0000-0x00000000006ED000-memory.dmp

Filesize
180KB

Download
memory/3612-137-0x00000000006C0000-0x00000000006ED000-memory.dmp

Filesize
180KB

Download
memory/3612-138-0x00000000006C0000-0x00000000006ED000-memory.dmp

Filesize
180KB

Download
memory/3728-136-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download