bc44f40ef12c3698870c37693b93f879b91ce180dd266efcf835983233e222f3

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 07:28

Target

bc44f40ef12c3698870c37693b93f879b91ce180dd266efcf835983233e222f3.dll
Size

113KB
MD5

374c8aefa3b54fa755b30fa2c3013a90
SHA1

f6438d3781bfa8bb36bbeca91ce3681e30ff2fa2
SHA256

bc44f40ef12c3698870c37693b93f879b91ce180dd266efcf835983233e222f3
SHA512

76e0d960515d21ceb91c76175d119bd7cb3df696536b1c4fb4ee89c77f85948fe0ebce7e18cf41db9760b22830c7569060235666b8c11f31434714fb380b576c
SSDEEP

3072:xHMPqlBbtpyq7M45bjxiLvk89IS8L+IW6:xHMQBbtpbTuLc89IS8R

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5092	5072	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 5072	4992	rundll32.exe	81
PID 4992 wrote to memory of 5072	4992	rundll32.exe	81
PID 4992 wrote to memory of 5072	4992	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc44f40ef12c3698870c37693b93f879b91ce180dd266efcf835983233e222f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc44f40ef12c3698870c37693b93f879b91ce180dd266efcf835983233e222f3.dll,#1
  2⤵
  PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 636
    3⤵
    - Program crash
    PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5072 -ip 5072
1⤵
PID:2820

memory/5072-133-0x0000000000FF0000-0x0000000000FFF000-memory.dmp

Filesize
60KB

Download
memory/5072-134-0x0000000001310000-0x0000000001330000-memory.dmp

Filesize
128KB

Download
memory/5072-138-0x0000000000FF0000-0x0000000000FFF000-memory.dmp

Filesize
60KB

Download