c886b998a42fed1b1e147be9791507c29317676f4a69a35e6e3a3207b3567e2f

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 17:39

Target

1672-97-0x0000000000200000-0x000000000022A000-memory.dll
Size

168KB
MD5

0164b20f2cb331f01f3ecd5dca29d31e
SHA1

693ac72f18ec24e6d3d8d772f851442ac6d25f7e
SHA256

c886b998a42fed1b1e147be9791507c29317676f4a69a35e6e3a3207b3567e2f
SHA512

68a22d4eb4965cdaec4b01f21981f01f2f75078965b9986a050acedf03578e7a097675d07308fb24297891d214194f575522c759f5b3e962d734a3b59ae816ed
SSDEEP

3072:SgiSH5HRFVScyzTBxwAWJKwTxnTBfZykO/yaGv:FdrVXyXBxFWJpTxnTBxyP/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4568 4960 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4568	4960	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5060 wrote to memory of 4960	5060	rundll32.exe	rundll32.exe
PID 5060 wrote to memory of 4960	5060	rundll32.exe	rundll32.exe
PID 5060 wrote to memory of 4960	5060	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1672-97-0x0000000000200000-0x000000000022A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1672-97-0x0000000000200000-0x000000000022A000-memory.dll,#1
2⤵
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 560
3⤵
- Program crash
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4960 -ip 4960
1⤵
PID:544