dbbc6b844b25a3d3ee4e0ef40da41ea320ac1bece77157d93841fda64cc27491

Analysis

max time kernel
206s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 14:29

Target

dbbc6b844b25a3d3ee4e0ef40da41ea320ac1bece77157d93841fda64cc27491.dll
Size

126KB
MD5

534fcff492cc54f0c26a28487c565bb6
SHA1

1861aa01d6c3b49e2fce26616f768ba3e031b146
SHA256

dbbc6b844b25a3d3ee4e0ef40da41ea320ac1bece77157d93841fda64cc27491
SHA512

4d5b52d1b2a14611c747c4117a2a098dc5c0627d453c55295a195320468bc72e26106476dacf694df4f29348cb2dc7d1455b0a05820b8dc20a83ff92538b2c07
SSDEEP

1536:AQxmkWtyMsaAkK1Q+vdwPPtS02Z2dSGkdAB9hPRO7rbEXKfyt4z0:otw51tcQCcBdAThw7roXKfHo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	2772	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 2772	224	rundll32.exe	83
PID 224 wrote to memory of 2772	224	rundll32.exe	83
PID 224 wrote to memory of 2772	224	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbbc6b844b25a3d3ee4e0ef40da41ea320ac1bece77157d93841fda64cc27491.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbbc6b844b25a3d3ee4e0ef40da41ea320ac1bece77157d93841fda64cc27491.dll,#1
  2⤵
  PID:2772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 600
    3⤵
    - Program crash
    PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 2772 -ip 2772
1⤵
PID:3744

memory/2772-133-0x0000000010000000-0x0000000010049000-memory.dmp

Filesize
292KB

Download