6004e7bce21903f5c8b064b0e6a7bd83a68e52740879e04b6863983267150777

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 17:26

Target

1680-97-0x0000000000250000-0x000000000027A000-memory.dll
Size

168KB
MD5

95d73563c8429ab1201c3f5c475cf53a
SHA1

18c7a0ff06d14ed2799ba5d92254334f14edb2ae
SHA256

6004e7bce21903f5c8b064b0e6a7bd83a68e52740879e04b6863983267150777
SHA512

daea97845543ce04ddd60ecbb0d6a45f222d2e1c58406ac9e07f655b7b164e5b6465cf2c1d8e0afac55800fd644b91ab521dd1634b3943e6da33354dd230b8b7
SSDEEP

3072:ogSPueeAMUSf/vGctAcJTRFg3TBfpA5O/yaGv:pzdDfXGcucJVFg3TBhAQ/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4828 1632 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4828	1632	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4736 wrote to memory of 1632	4736	rundll32.exe	rundll32.exe
PID 4736 wrote to memory of 1632	4736	rundll32.exe	rundll32.exe
PID 4736 wrote to memory of 1632	4736	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1680-97-0x0000000000250000-0x000000000027A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4736

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1680-97-0x0000000000250000-0x000000000027A000-memory.dll,#1
2⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 560
3⤵
- Program crash
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1632 -ip 1632
1⤵
PID:1120