395cf3cf646c755d2c82f892a257a6892f27950b2573f812832dfcd296c7c8b9

Analysis

max time kernel
174s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 15:04

Target

395cf3cf646c755d2c82f892a257a6892f27950b2573f812832dfcd296c7c8b9.dll
Size

166KB
MD5

3b0909d311c9f58d975b4c7cb3d4e1ec
SHA1

17ece2ae7b13d847271ca6f0f06882f2d69f9934
SHA256

395cf3cf646c755d2c82f892a257a6892f27950b2573f812832dfcd296c7c8b9
SHA512

1621b0762e86ed8d81e627d154dc7e63c5344c0367e7d8da59b5825da3864e4c7495ebb693561c78feeee676f665a54860facb423ec87c420ac2d59609870bcb
SSDEEP

3072:PkE6hNXJ1+hiW7KEAvNsGoOwpWtVEOw2bGRF1hKwKv3ehltlS6:PkPhdKiWuE9OsWMOOJhKdWn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4308	2320	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 2320	4612	rundll32.exe	85
PID 4612 wrote to memory of 2320	4612	rundll32.exe	85
PID 4612 wrote to memory of 2320	4612	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\395cf3cf646c755d2c82f892a257a6892f27950b2573f812832dfcd296c7c8b9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\395cf3cf646c755d2c82f892a257a6892f27950b2573f812832dfcd296c7c8b9.dll,#1
  2⤵
  PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 632
    3⤵
    - Program crash
    PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2320 -ip 2320
1⤵
PID:1000

memory/2320-133-0x0000000000A10000-0x0000000000A25000-memory.dmp

Filesize
84KB

Download
memory/2320-134-0x0000000000B10000-0x0000000000B3D000-memory.dmp

Filesize
180KB

Download
memory/2320-138-0x0000000000A10000-0x0000000000A25000-memory.dmp

Filesize
84KB

Download