3ec26d4e91b0154f4372d2fc24acc0396a601c9986db7299c51ea31a90cb8527

Analysis

max time kernel
105s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2022 02:15

Target

3ec26d4e91b0154f4372d2fc24acc0396a601c9986db7299c51ea31a90cb8527.dll
Size

203KB
MD5

f864e755b044a3ccf7047218dbc53b22
SHA1

295399c78ad812d226d9bc0c21439fdc7a895f51
SHA256

3ec26d4e91b0154f4372d2fc24acc0396a601c9986db7299c51ea31a90cb8527
SHA512

0956578e9651b30e8ee9a469907234a8594cc1916d3a86e4c23bbaf86a35d5f74714c5d0eb0f2ee024870d1c9e01bf97e12a0df8e5bb892bde6930374e831b13
SSDEEP

6144:obVFbLC1wi1/N224cZALI0/FNsOiOiOiOJ6M:ohFbG1/JR0/FNsOiOiOiOQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4304	1312	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 1312	4252	rundll32.exe	81
PID 4252 wrote to memory of 1312	4252	rundll32.exe	81
PID 4252 wrote to memory of 1312	4252	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec26d4e91b0154f4372d2fc24acc0396a601c9986db7299c51ea31a90cb8527.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec26d4e91b0154f4372d2fc24acc0396a601c9986db7299c51ea31a90cb8527.dll,#1
  2⤵
  PID:1312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 640
    3⤵
    - Program crash
    PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1312 -ip 1312
1⤵
PID:1428

memory/1312-133-0x0000000000640000-0x000000000067C000-memory.dmp

Filesize
240KB

Download