9b073d823c2b996c202a78f9459c56fc0e5ded07672ebc20892c84398d12b839

Analysis

max time kernel
197s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 11:20

Target

9b073d823c2b996c202a78f9459c56fc0e5ded07672ebc20892c84398d12b839.dll
Size

124KB
MD5

1663b0ac575fd17d93ccc69073b0cb10
SHA1

6dde0404ec24a388ca4f44a703728da7abe2054a
SHA256

9b073d823c2b996c202a78f9459c56fc0e5ded07672ebc20892c84398d12b839
SHA512

aac5f94306c8e9f73a7c9185c7217fffaf973640de1f3078ded7adbddf8b82314671565600d10297ae50e885e99899702aec5e5a713c97db5e7e1c9d4551a870
SSDEEP

3072:Z8sDGD4xm08ACF5jmlw4QwKh7jbsKjSgrtC:Z8swp085nqu4UhLsK/rtC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4992	1864	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 1864	4260	rundll32.exe	80
PID 4260 wrote to memory of 1864	4260	rundll32.exe	80
PID 4260 wrote to memory of 1864	4260	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b073d823c2b996c202a78f9459c56fc0e5ded07672ebc20892c84398d12b839.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b073d823c2b996c202a78f9459c56fc0e5ded07672ebc20892c84398d12b839.dll,#1
  2⤵
  PID:1864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 600
    3⤵
    - Program crash
    PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1864 -ip 1864
1⤵
PID:4004

memory/1864-133-0x0000000010000000-0x0000000010143000-memory.dmp

Filesize
1.3MB

Download