b7c5621a07a840245f2058f900f48495e8eeb61cd566e96b9c94d6e04ab44347

Analysis

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 07:59

Target

b7c5621a07a840245f2058f900f48495e8eeb61cd566e96b9c94d6e04ab44347.dll
Size

34KB
MD5

9c02235075c8a9b91ab957ba23b216b0
SHA1

dc72792b6602f5ebbde1bb79325428341f210a18
SHA256

b7c5621a07a840245f2058f900f48495e8eeb61cd566e96b9c94d6e04ab44347
SHA512

7663847ca2aaf526bee0c78ce194c1019a849626492df67df93eba24a8f173ea72792c4d07390c9684f1a65715f7034402e6ffd9f348ecf3451a888d68857912
SSDEEP

768:z/5EAZZWi3btVViGHVEHWXGT7nKEglw3VsApGzV:2Az1LLoAVaIApGzV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4244	3268	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 3268	1376	rundll32.exe	81
PID 1376 wrote to memory of 3268	1376	rundll32.exe	81
PID 1376 wrote to memory of 3268	1376	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7c5621a07a840245f2058f900f48495e8eeb61cd566e96b9c94d6e04ab44347.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7c5621a07a840245f2058f900f48495e8eeb61cd566e96b9c94d6e04ab44347.dll,#1
  2⤵
  PID:3268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 580
    3⤵
    - Program crash
    PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3268 -ip 3268
1⤵
PID:2164

memory/3268-132-0x0000000000000000-mapping.dmp

Download
memory/3268-133-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download