b7daf06bf563fc2f566db44bef233b92c5d1fc8dc569723c264db88edde23f94

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 07:58

Target

b7daf06bf563fc2f566db44bef233b92c5d1fc8dc569723c264db88edde23f94.dll
Size

88KB
MD5

58b356d6fd5e6835b1b7fecf4bc129c0
SHA1

0673f2bb993882c51fb90ea6d5574cad1d25c53d
SHA256

b7daf06bf563fc2f566db44bef233b92c5d1fc8dc569723c264db88edde23f94
SHA512

ce05007b1145e6357897a0999394803bbd463fe2d71fd5545df949ed74d342dff231aa0063bde366ec699644848cd4cd42da3ef56a3609d846032b9dfe655341
SSDEEP

1536:B3ETstzWmNGYsDW6oH4/s91CnhQ7XTZdN+LVtwVmdJl9Ygmo/HhzvVrhg:T3BsDOzKnC7jZangS9YkHhzpO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	4856	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4856	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4856	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4856	4804	rundll32.exe	81
PID 4804 wrote to memory of 4856	4804	rundll32.exe	81
PID 4804 wrote to memory of 4856	4804	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7daf06bf563fc2f566db44bef233b92c5d1fc8dc569723c264db88edde23f94.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7daf06bf563fc2f566db44bef233b92c5d1fc8dc569723c264db88edde23f94.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 628
    3⤵
    - Program crash
    PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4856 -ip 4856
1⤵
PID:4920

memory/4856-133-0x0000000000420000-0x0000000000434000-memory.dmp

Filesize
80KB

Download
memory/4856-134-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4856-135-0x0000000000420000-0x0000000000434000-memory.dmp

Filesize
80KB

Download