dbcfbb2cbf1f139558907221c4399fad834a5d331d485b66c4e11b0c424bd105

Analysis

max time kernel
178s
max time network
252s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 14:29

Target

dbcfbb2cbf1f139558907221c4399fad834a5d331d485b66c4e11b0c424bd105.dll
Size

78KB
MD5

fc99558385c60a508335c0fc622d863e
SHA1

8a452acdf902e9e009fc6eda3e95302c4d231639
SHA256

dbcfbb2cbf1f139558907221c4399fad834a5d331d485b66c4e11b0c424bd105
SHA512

bd0326468e9b87613e9af13a7ef23d8105129ea2e038381defc29f42bd21044091316e3e76a06ba26b83fb7d477627e128be36000f3a5d22b6a2e5141f38ea18
SSDEEP

1536:BMMObIsZaUQxJUHmoW7qhWnGMn3jO1cdooaAoodtmTFwuQi16ml+M:iNERpxJUiWY40aBMtmZB4M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4048	1400	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 1400	4236	rundll32.exe	79
PID 4236 wrote to memory of 1400	4236	rundll32.exe	79
PID 4236 wrote to memory of 1400	4236	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbcfbb2cbf1f139558907221c4399fad834a5d331d485b66c4e11b0c424bd105.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbcfbb2cbf1f139558907221c4399fad834a5d331d485b66c4e11b0c424bd105.dll,#1
  2⤵
  PID:1400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 592
    3⤵
    - Program crash
    PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1400 -ip 1400
1⤵
PID:4552

memory/1400-133-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download