9c04b89cd6ac1024a5ce7551a4f897d8d6dc83f6d4a69c21ef0d7d912d059323

Analysis

max time kernel
91s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 01:46

Target

9c04b89cd6ac1024a5ce7551a4f897d8d6dc83f6d4a69c21ef0d7d912d059323.dll
Size

178KB
MD5

772ed458fa8a90dc2e9ba4f265b50dc2
SHA1

dd474b60bb9c6db1d991356280d39e91e9ede9fa
SHA256

9c04b89cd6ac1024a5ce7551a4f897d8d6dc83f6d4a69c21ef0d7d912d059323
SHA512

f163b0c328605ed22e336e9ac2fb3a16cc80d1ca26a923fc9ec8e531ba3e081ef742e7eb60655fa96f6357b253601558f54b3244ed52919d5f9af524b030db27
SSDEEP

3072:a4Y4C2x9OenRhtFdBAXKasJZegPlP08aow8xHAbNRDkfMa96Pn8neR8DV:fxVx95PFJasZr/w2HAbNpGCn8eR8p

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4816	4932	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 4932	3156	rundll32.exe	79
PID 3156 wrote to memory of 4932	3156	rundll32.exe	79
PID 3156 wrote to memory of 4932	3156	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c04b89cd6ac1024a5ce7551a4f897d8d6dc83f6d4a69c21ef0d7d912d059323.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c04b89cd6ac1024a5ce7551a4f897d8d6dc83f6d4a69c21ef0d7d912d059323.dll,#1
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 632
    3⤵
    - Program crash
    PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4932 -ip 4932
1⤵
PID:4928

memory/4932-133-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download