f9ba86f6b3a5b56af3949ead658cc13aed9593833c9a6f9f731923529f52bad2

Analysis

max time kernel
62s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 14:01

Target

f9ba86f6b3a5b56af3949ead658cc13aed9593833c9a6f9f731923529f52bad2.dll
Size

97KB
MD5

1ebfbb45f030b45991bef92c21e5c6b4
SHA1

30ffe1d5f72595d944e4266575e42150fa13557d
SHA256

f9ba86f6b3a5b56af3949ead658cc13aed9593833c9a6f9f731923529f52bad2
SHA512

8a01446a0b01f7119ceb954ba5142c6b898a11471a2450f559d7de7c22c869299af207789bf839914d6795d4d4c13f04ffbc2d384bed4f9eed553397fd725189
SSDEEP

1536:FbeuzkkN4j+6kmF/AyNUvFL4UaLIYnV4WGU2mZPAW1k8jgWAy9GpR/9jb:FeMkhEFUUaLIYnVPd2KYmlUx9jb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5012	2344	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2344	2044	rundll32.exe	81
PID 2044 wrote to memory of 2344	2044	rundll32.exe	81
PID 2044 wrote to memory of 2344	2044	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9ba86f6b3a5b56af3949ead658cc13aed9593833c9a6f9f731923529f52bad2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9ba86f6b3a5b56af3949ead658cc13aed9593833c9a6f9f731923529f52bad2.dll,#1
  2⤵
  PID:2344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 580
    3⤵
    - Program crash
    PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2344 -ip 2344
1⤵
PID:4156

memory/2344-133-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/2344-134-0x0000000002DD0000-0x0000000002EE9000-memory.dmp

Filesize
1.1MB

Download