c686234edcad81c871ed81adb6304885df879da8edc74500077b8be530447122

Analysis

max time kernel
106s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 07:09

Target

c686234edcad81c871ed81adb6304885df879da8edc74500077b8be530447122.dll
Size

177KB
MD5

55a6cf3eec221ddd91bd43865d3bce7b
SHA1

351f6c13ca845df15f67a7bc23ac99037c11d427
SHA256

c686234edcad81c871ed81adb6304885df879da8edc74500077b8be530447122
SHA512

7796abced5ff387f40fa4d51f690ec2f49c9d15c60faeb3c6bc67079e9845ff31d606570663325962598e488f1509efc2ac05f7fca29c759b4145e99c206e5f8
SSDEEP

3072:AMq7vlFIFC2xxa0M1NkUuXD02/52kPzxz2W5B2QQaP6LkDNJ2Su:AZvvIn2nkUL2/5zDQSfO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	1564	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1564	2348	rundll32.exe	82
PID 2348 wrote to memory of 1564	2348	rundll32.exe	82
PID 2348 wrote to memory of 1564	2348	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c686234edcad81c871ed81adb6304885df879da8edc74500077b8be530447122.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c686234edcad81c871ed81adb6304885df879da8edc74500077b8be530447122.dll,#1
  2⤵
  PID:1564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 544
    3⤵
    - Program crash
    PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1564 -ip 1564
1⤵
PID:1760

memory/1564-133-0x0000000000FA0000-0x0000000000FC9000-memory.dmp

Filesize
164KB

Download