e3d22921bf8fa57685bc7bc8b3184041e70d677fa41f4b3a786c3494d0d89fbe

Analysis

max time kernel
167s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 06:42

Target

e3d22921bf8fa57685bc7bc8b3184041e70d677fa41f4b3a786c3494d0d89fbe.dll
Size

14KB
MD5

637b32a22cf18774ee8d3c461c15e810
SHA1

39a83efc40601371b6e48c2deb1acde2a7ce83f8
SHA256

e3d22921bf8fa57685bc7bc8b3184041e70d677fa41f4b3a786c3494d0d89fbe
SHA512

db59d76687c526ad5735928e598099d3bf408225d3f3f1605bf5d56c6dc7b2c6e6c65f19258858e28db5c6878de4343b8c9420711c62f21b52bdf9be9d51bf1a
SSDEEP

384:N1/t+TR/jcTFruGOJj+vj2kE2ZTTPSZO5Sdded7B:/ECFSGE+2k/fPQgSdo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4840	2944	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 2944	4540	rundll32.exe	79
PID 4540 wrote to memory of 2944	4540	rundll32.exe	79
PID 4540 wrote to memory of 2944	4540	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3d22921bf8fa57685bc7bc8b3184041e70d677fa41f4b3a786c3494d0d89fbe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3d22921bf8fa57685bc7bc8b3184041e70d677fa41f4b3a786c3494d0d89fbe.dll,#1
  2⤵
  PID:2944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 568
    3⤵
    - Program crash
    PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2944 -ip 2944
1⤵
PID:3716

memory/2944-133-0x00000000001E0000-0x00000000001EF000-memory.dmp

Filesize
60KB

Download
memory/2944-134-0x00000000001F0000-0x00000000001FA000-memory.dmp

Filesize
40KB

Download
memory/2944-135-0x00000000001F0000-0x00000000001FA000-memory.dmp

Filesize
40KB

Download