e0bc4901cf1b0abbb559187fb7aa294cb2754398faca72ad2eafadd5319158c0

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 14:01

Target

e0bc4901cf1b0abbb559187fb7aa294cb2754398faca72ad2eafadd5319158c0.dll
Size

95KB
MD5

c8cb96babe0a5018e3037181af943422
SHA1

702295c3b07fc6bde9c0136078e4709c0869e61e
SHA256

e0bc4901cf1b0abbb559187fb7aa294cb2754398faca72ad2eafadd5319158c0
SHA512

d53094bed34aabb8dbf4e0f0725bc944037a51d3fe5ddd004c3799aed6593106d49040f43994d232097472c6820cf9eaa2d25f11d1ff6a48313d2e63d70e4238
SSDEEP

1536:409WQFumARR78bILNBBS8vqUL60pjI3Pvy54Sdb6cbw55DH2KmLmId+LXIA4vIXS:/fyV8bcY8lL6s03Pvymi/A2NyCwXz9ju

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4808	4868	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4868	4824	rundll32.exe	80
PID 4824 wrote to memory of 4868	4824	rundll32.exe	80
PID 4824 wrote to memory of 4868	4824	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0bc4901cf1b0abbb559187fb7aa294cb2754398faca72ad2eafadd5319158c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0bc4901cf1b0abbb559187fb7aa294cb2754398faca72ad2eafadd5319158c0.dll,#1
  2⤵
  PID:4868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 580
    3⤵
    - Program crash
    PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4868 -ip 4868
1⤵
PID:4920

memory/4868-133-0x0000000002330000-0x0000000002446000-memory.dmp

Filesize
1.1MB

Download