97426d9a49ac8e15b09a2ac0e735fb3a465f8f38952a9fbe7b25495bb13a1759

Analysis

max time kernel
152s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 11:49

Target

97426d9a49ac8e15b09a2ac0e735fb3a465f8f38952a9fbe7b25495bb13a1759.dll
Size

85KB
MD5

57116df279075a47a88a010081711835
SHA1

8db11f8006a16e0c0273e7bc7d2d2d6f99d8f790
SHA256

97426d9a49ac8e15b09a2ac0e735fb3a465f8f38952a9fbe7b25495bb13a1759
SHA512

cf2972ff392f6794d8c6d2b6ce706a16ad8e6c4040aee93cf8ee7ce640bd76a4bf5b879987a680ac2a4650e2c4f980db91f7e3f472f168cb43632732050b7b7f
SSDEEP

1536:84APtdEjwvGzkuNMckO/jxl4YSOxIzsi3M:LAPtxvGz3kO/jxlHxg1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4612	2988	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 2988	380	rundll32.exe	81
PID 380 wrote to memory of 2988	380	rundll32.exe	81
PID 380 wrote to memory of 2988	380	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97426d9a49ac8e15b09a2ac0e735fb3a465f8f38952a9fbe7b25495bb13a1759.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97426d9a49ac8e15b09a2ac0e735fb3a465f8f38952a9fbe7b25495bb13a1759.dll,#1
  2⤵
  PID:2988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 580
    3⤵
    - Program crash
    PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2988 -ip 2988
1⤵
PID:4652

memory/2988-133-0x0000000001F20000-0x0000000002007000-memory.dmp

Filesize
924KB

Download