a1602cccedfad0491732c12c699cda954fdae12a68ffa8e4d26189d6ba17e80f

Analysis

max time kernel
64s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 10:33

Target

a1602cccedfad0491732c12c699cda954fdae12a68ffa8e4d26189d6ba17e80f.dll
Size

17KB
MD5

ff78b52b694076fdc8f1027283adff80
SHA1

cb1d6dbe07e08bfa3637ef52004f096376ee1b45
SHA256

a1602cccedfad0491732c12c699cda954fdae12a68ffa8e4d26189d6ba17e80f
SHA512

f6cd9e0c7059da846653c4e7b7f6a491920b123621634278d53238c72eb6f2d30d4e05d2f68e08f418a04e87c75d6a43b7865aeb7f97d585f74fad01d19564c2
SSDEEP

384:oJkOzl1dT5YlsN8lzeLQZR4y7hCZLdYf5B/1cj+/mS:IV5Yls66LKxhCZhYBncj+x

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	1884	WerFault.exe	75

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1884	rundll32.exe
1884	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 1884	3540	rundll32.exe	75
PID 3540 wrote to memory of 1884	3540	rundll32.exe	75
PID 3540 wrote to memory of 1884	3540	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1602cccedfad0491732c12c699cda954fdae12a68ffa8e4d26189d6ba17e80f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1602cccedfad0491732c12c699cda954fdae12a68ffa8e4d26189d6ba17e80f.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 584
    3⤵
    - Program crash
    PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1884 -ip 1884
1⤵
PID:3876

memory/1884-132-0x0000000000000000-mapping.dmp

Download
memory/1884-133-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1884-134-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1884-135-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download