bf7db9377fd34dddeebfd34ed40b51da70a13cf92d3656074bb074d038c62d7f

Analysis

max time kernel
157s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 13:23

Target

bf7db9377fd34dddeebfd34ed40b51da70a13cf92d3656074bb074d038c62d7f.dll
Size

148KB
MD5

b31f002c1bb3c7a24a4f8fc8c2ae8834
SHA1

9811799323d465568848e9915d25f37efe2d5c3f
SHA256

bf7db9377fd34dddeebfd34ed40b51da70a13cf92d3656074bb074d038c62d7f
SHA512

64e0bedd8a5e2c7bfc97abc7f3e53e491e0d88565a8777f6f6084d903c682e156a8e61e6b36c04e704aa46101e0051b0d08cab9471b952d741ed2912b5a795f8
SSDEEP

3072:fH71oVlpRk1EAnxMJ8jYFkFXs9Wafwiq:v7iSEuI8gkFXhao1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1808	1260	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 1260	4500	rundll32.exe	80
PID 4500 wrote to memory of 1260	4500	rundll32.exe	80
PID 4500 wrote to memory of 1260	4500	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf7db9377fd34dddeebfd34ed40b51da70a13cf92d3656074bb074d038c62d7f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf7db9377fd34dddeebfd34ed40b51da70a13cf92d3656074bb074d038c62d7f.dll,#1
  2⤵
  PID:1260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 544
    3⤵
    - Program crash
    PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1260 -ip 1260
1⤵
PID:2212

memory/1260-133-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download