904f99dca44f2cc7390ecc5701c8cc05370381ffbccf1926b72375a96ee569ab

Analysis

max time kernel
160s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 12:37

Target

904f99dca44f2cc7390ecc5701c8cc05370381ffbccf1926b72375a96ee569ab.dll
Size

10KB
MD5

6fcc9716a8a4df4f881358961f997760
SHA1

26c04fe9a6ca53a2eb839a92791448e9080ce459
SHA256

904f99dca44f2cc7390ecc5701c8cc05370381ffbccf1926b72375a96ee569ab
SHA512

13644d61c046432a0a867d851439bfbd322d4915d57e9468edb32119b1acf733b43de5f50d41f3c4be99284bea04c348039d142313c4b033a235a49bc602c9d8
SSDEEP

192:QussvJ85sgNUcX+5QqMsAAoc4h6GbAPDSqM0n+8AMau/ZX:DsYysgNdX+5QqoAoV6uAPDSdydZX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3404	4740	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 4740	5096	rundll32.exe	80
PID 5096 wrote to memory of 4740	5096	rundll32.exe	80
PID 5096 wrote to memory of 4740	5096	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\904f99dca44f2cc7390ecc5701c8cc05370381ffbccf1926b72375a96ee569ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\904f99dca44f2cc7390ecc5701c8cc05370381ffbccf1926b72375a96ee569ab.dll,#1
  2⤵
  PID:4740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 544
    3⤵
    - Program crash
    PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4740 -ip 4740
1⤵
PID:768

memory/4740-133-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download