f03893339813c7da36576b666a83abafad8ca06fadb5f120af10efe71fd6a2e2

Analysis

max time kernel
186s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 05:59

Target

f03893339813c7da36576b666a83abafad8ca06fadb5f120af10efe71fd6a2e2.dll
Size

256KB
MD5

1f2c08bb614c8f0f53de53ffd3a0ba6e
SHA1

cad49c446e1517ed4c4804dc9df33f6bc7a68e13
SHA256

f03893339813c7da36576b666a83abafad8ca06fadb5f120af10efe71fd6a2e2
SHA512

b5bb19c1aefdf4cec85ea51e8b1ad083b591c9a289759f785ee0fd5cb9b8b3c6fdf8ca07dcd01dc0c39a440eb9d53726b83d7cb5b7d7a2e662a4b0f01a55494b
SSDEEP

3072:5sC33rr/sJPp5dDdslWJL//IZZfDniEQtWS7bZL5JQXT7iw51UilCNxnEh4YMDl3:V+PRDdsML//Eov5Y3wilCMgrDqPX1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4388	3044	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 3044	4112	rundll32.exe	84
PID 4112 wrote to memory of 3044	4112	rundll32.exe	84
PID 4112 wrote to memory of 3044	4112	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f03893339813c7da36576b666a83abafad8ca06fadb5f120af10efe71fd6a2e2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f03893339813c7da36576b666a83abafad8ca06fadb5f120af10efe71fd6a2e2.dll,#1
  2⤵
  PID:3044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 588
    3⤵
    - Program crash
    PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3044 -ip 3044
1⤵
PID:4064

memory/3044-133-0x0000000000C70000-0x0000000000CAF000-memory.dmp

Filesize
252KB

Download