c1eb4982192180c15b1b311fbfc3a7fa2bb8b23f1a51d9c87014151d1ce3b8f5

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 01:46

Target

c1eb4982192180c15b1b311fbfc3a7fa2bb8b23f1a51d9c87014151d1ce3b8f5.dll
Size

212KB
MD5

b0817977ff095dbd84ada60e7f436b9b
SHA1

8e28f0ba7438d3e055e07f5c38a9f90726980b82
SHA256

c1eb4982192180c15b1b311fbfc3a7fa2bb8b23f1a51d9c87014151d1ce3b8f5
SHA512

99008c3ca85c092ddf61db6ed2ad03dbf733a290c80f1a290b50b5cfcc4c1ab2bf02d856804fb703d07f46d16df76b216ddbb8dcb07f11fdb0ada8020675d854
SSDEEP

3072:xN8D1I4btSRqh2OuybQFqb1KV8eoLXvZ877IqM6dkoOs8IAOyqJqWTwffWNf:xmsdnLVuDv677IsdkPs8IApqo7ne

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	2972	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2972	2492	rundll32.exe	80
PID 2492 wrote to memory of 2972	2492	rundll32.exe	80
PID 2492 wrote to memory of 2972	2492	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1eb4982192180c15b1b311fbfc3a7fa2bb8b23f1a51d9c87014151d1ce3b8f5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1eb4982192180c15b1b311fbfc3a7fa2bb8b23f1a51d9c87014151d1ce3b8f5.dll,#1
  2⤵
  PID:2972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 632
    3⤵
    - Program crash
    PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2972 -ip 2972
1⤵
PID:404

memory/2972-133-0x0000000010000000-0x00000000100B1000-memory.dmp

Filesize
708KB

Download