2ca0bfc095fe91fa647ee51fabe976321ae93f3b430d2e50dc071412c60ced23

Analysis

max time kernel
173s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 01:51

Target

2ca0bfc095fe91fa647ee51fabe976321ae93f3b430d2e50dc071412c60ced23.dll
Size

90KB
MD5

7546f7c970b414d5e80657e46c248d80
SHA1

8634e4aec554c8ad54e7cf1788919dc10ff75c5b
SHA256

2ca0bfc095fe91fa647ee51fabe976321ae93f3b430d2e50dc071412c60ced23
SHA512

72b8f665f9fd57ecb5d8cec71a344a403dbb4690260249661100fe577293cab75a03d4c491974e8eb4ec77205fd6fa67231986ac437c8dc6c75ca7adf536d2d4
SSDEEP

768:4O22p+q7Al+xuOr00C++Ox0OIPLKvzZs9Lybw441wBlGhJ3NBhnSSVPu9VCneC48:YasZ2k9Ox0OIPLKvzwM414O8jO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1332	1364	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 1364	4540	rundll32.exe	80
PID 4540 wrote to memory of 1364	4540	rundll32.exe	80
PID 4540 wrote to memory of 1364	4540	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ca0bfc095fe91fa647ee51fabe976321ae93f3b430d2e50dc071412c60ced23.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ca0bfc095fe91fa647ee51fabe976321ae93f3b430d2e50dc071412c60ced23.dll,#1
  2⤵
  PID:1364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 604
    3⤵
    - Program crash
    PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1364 -ip 1364
1⤵
PID:1904

memory/1364-133-0x0000000020000000-0x000000002001D000-memory.dmp

Filesize
116KB

Download