9e98fde5df757f335f6dcd08a41278304292221850f722b7344490bbcfc2a3ce

Analysis

max time kernel
151s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2022 02:47

Target

9e98fde5df757f335f6dcd08a41278304292221850f722b7344490bbcfc2a3ce.dll
Size

85KB
MD5

476c7edb8e576a5caeda9e45965581f0
SHA1

39d2e654181934e9a587e5a54237ab50cd4a6683
SHA256

9e98fde5df757f335f6dcd08a41278304292221850f722b7344490bbcfc2a3ce
SHA512

fb690b67cc3a5024c7a8545cc4ab6f06c638078f72732d9c38aa5c3a5e7fa022fcb4e9304881cbbc49dcc31b9ef93af994acf07be136b84819a2d89c1ee1a464
SSDEEP

1536:5USv/m3CwYV7QR0DvBoRgB1yk3I5+VYB7gQXAi5x7kKguT4Z0DT/eT1:5USveSwYWuDJYkeZnAizgsDTe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	1952	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 1952	4284	rundll32.exe	82
PID 4284 wrote to memory of 1952	4284	rundll32.exe	82
PID 4284 wrote to memory of 1952	4284	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e98fde5df757f335f6dcd08a41278304292221850f722b7344490bbcfc2a3ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e98fde5df757f335f6dcd08a41278304292221850f722b7344490bbcfc2a3ce.dll,#1
  2⤵
  PID:1952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 596
    3⤵
    - Program crash
    PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1952 -ip 1952
1⤵
PID:2756

memory/1952-133-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download