a891e831c8f7d05e5403cfa3d5cce5937b512dead9146bfdfdbb2d72d2bbdefb

Analysis

max time kernel
91s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 12:11

Target

a891e831c8f7d05e5403cfa3d5cce5937b512dead9146bfdfdbb2d72d2bbdefb.dll
Size

144KB
MD5

37f12f5203e1008e254c33ed5c697da5
SHA1

4482eef11be48eba1ecd169b04beaa3697f167dc
SHA256

a891e831c8f7d05e5403cfa3d5cce5937b512dead9146bfdfdbb2d72d2bbdefb
SHA512

b0fd9b11f5414e5dddbe195494e40cee96ab47241624a35700f8254da994a43015862c44817453dbc1a44e4122b57497e94def365f6941a1a77160e0b2377d91
SSDEEP

3072:ndUP4vpdFCd6w+JaO1bP7O+Qc3q3FmqacLSSeKRAJEolPzTQZ51LEN1E8QorKgo:nmtWXG1mqacLSSx0zTQZ4jEPQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2368	4656	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4656	4756	rundll32.exe	79
PID 4756 wrote to memory of 4656	4756	rundll32.exe	79
PID 4756 wrote to memory of 4656	4756	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a891e831c8f7d05e5403cfa3d5cce5937b512dead9146bfdfdbb2d72d2bbdefb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a891e831c8f7d05e5403cfa3d5cce5937b512dead9146bfdfdbb2d72d2bbdefb.dll,#1
  2⤵
  PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 628
    3⤵
    - Program crash
    PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4656 -ip 4656
1⤵
PID:868

memory/4656-133-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/4656-134-0x0000000000470000-0x000000000047F000-memory.dmp

Filesize
60KB

Download
memory/4656-135-0x0000000000590000-0x000000000059F000-memory.dmp

Filesize
60KB

Download