c0594068999ed9f0d9181a311512c4b7715d7fcfebafb9dfba1e841954cd91ab

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 07:01

Target

c0594068999ed9f0d9181a311512c4b7715d7fcfebafb9dfba1e841954cd91ab.dll
Size

30KB
MD5

c187a1369e00e57c62c9de91c55fe4c0
SHA1

91847a68021d31c19a888618bffb32f26714b23f
SHA256

c0594068999ed9f0d9181a311512c4b7715d7fcfebafb9dfba1e841954cd91ab
SHA512

735860b1e417f4f76435d0ebb72d549c3807ff18574e4f1ce1446fe418ad60b424858ff224f5f50b1f073cf0cd3bd46b362dbdbe06eee3956f81b24ad09f6cf6
SSDEEP

768:CyCx/WTXDzRNwkYLYg0QR+wn6EqJ6avvo:tXdNvYLYdI+w6rv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5028	5048	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 5048	2376	rundll32.exe	80
PID 2376 wrote to memory of 5048	2376	rundll32.exe	80
PID 2376 wrote to memory of 5048	2376	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0594068999ed9f0d9181a311512c4b7715d7fcfebafb9dfba1e841954cd91ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0594068999ed9f0d9181a311512c4b7715d7fcfebafb9dfba1e841954cd91ab.dll,#1
  2⤵
  PID:5048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 540
    3⤵
    - Program crash
    PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5048 -ip 5048
1⤵
PID:2988

memory/5048-132-0x0000000000000000-mapping.dmp

Download
memory/5048-133-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download