e1b769e5d916e9a2ea12200813ad8ebfa1c98b96d371f9384ed14a7366455d3f

Analysis

max time kernel
189s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 13:45

Target

e1b769e5d916e9a2ea12200813ad8ebfa1c98b96d371f9384ed14a7366455d3f.dll
Size

308KB
MD5

8dca603d4c57df1a2023172597b0dc2d
SHA1

b35d81594b1c892734e396b3c7577b583bb7f4c3
SHA256

e1b769e5d916e9a2ea12200813ad8ebfa1c98b96d371f9384ed14a7366455d3f
SHA512

546c4ef80b483009af9ecd5686afbc9a5a382f04bd4d5d8c5de78b2184bfb95678165f27d77186ea04d774c65c0f073e578fc3ce810311740b1dff7d1d95e8d3
SSDEEP

6144:bre+pWADsyCxzPOQP76vEScrQI2r7QDroXoKHFwa:3e+cxVKQP7DrQIqwrtKlZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3416	484	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 484	3460	rundll32.exe	81
PID 3460 wrote to memory of 484	3460	rundll32.exe	81
PID 3460 wrote to memory of 484	3460	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1b769e5d916e9a2ea12200813ad8ebfa1c98b96d371f9384ed14a7366455d3f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1b769e5d916e9a2ea12200813ad8ebfa1c98b96d371f9384ed14a7366455d3f.dll,#1
  2⤵
  PID:484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 580
    3⤵
    - Program crash
    PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 484 -ip 484
1⤵
PID:344

memory/484-133-0x0000000010000000-0x00000000100A4000-memory.dmp

Filesize
656KB

Download