f25d37eae803d14b2c05553f053a73abfdba7c9bb33e488fd015468b61aa9939

Analysis

max time kernel
229s
max time network
242s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 02:45

Target

f25d37eae803d14b2c05553f053a73abfdba7c9bb33e488fd015468b61aa9939.dll
Size

86KB
MD5

c132a2c80594aae8017540d374921a8e
SHA1

d3bc877198ff647aefcc75745d03fa4376019449
SHA256

f25d37eae803d14b2c05553f053a73abfdba7c9bb33e488fd015468b61aa9939
SHA512

55088f5031c0dc512c603b37178029553865bbfa0a7937218b5114846a2f4cc8b2ccb6d780d11322fd3aae1b2df6bec9cc4ba1a115a0106cd14efbf00ee17236
SSDEEP

1536:hWc+PQK0cV0bjyArkgx97fjFCsjfeRmNZ/7olHsCy83wRoQwMO:hr7cV0bWJ07bljuwZTdC3wRPw7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	3396	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 3396	4928	rundll32.exe	78
PID 4928 wrote to memory of 3396	4928	rundll32.exe	78
PID 4928 wrote to memory of 3396	4928	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f25d37eae803d14b2c05553f053a73abfdba7c9bb33e488fd015468b61aa9939.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f25d37eae803d14b2c05553f053a73abfdba7c9bb33e488fd015468b61aa9939.dll,#1
  2⤵
  PID:3396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 608
    3⤵
    - Program crash
    PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3396 -ip 3396
1⤵
PID:4440

memory/3396-133-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download