ae9c0abbec32a93904df3a6a5baa2752197a0dd3f51a90b699f036b22ccab487

Analysis

max time kernel
137s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 02:25

Target

ae9c0abbec32a93904df3a6a5baa2752197a0dd3f51a90b699f036b22ccab487.dll
Size

88KB
MD5

01578d1bb87943ea1b8e6cb2e6878569
SHA1

85587319116762b7b65573090b8218f8674f1ddc
SHA256

ae9c0abbec32a93904df3a6a5baa2752197a0dd3f51a90b699f036b22ccab487
SHA512

0f45399bed3b0e7bbfe362168a8156abb7de59195dc0f0b9310916efca7dd9f233d845202333ca8a91d12e2f7880b3a9ed282ddb925ee3fd0e41ab285bf8c2d7
SSDEEP

1536:reK6pJ0Mx6cyaBUmNpxJbgwoxO57VN/uoI+IkrIm9X:CK6l6xOFUw+OxVtDLIkdX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2564	1200	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 1200	3452	rundll32.exe	80
PID 3452 wrote to memory of 1200	3452	rundll32.exe	80
PID 3452 wrote to memory of 1200	3452	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae9c0abbec32a93904df3a6a5baa2752197a0dd3f51a90b699f036b22ccab487.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae9c0abbec32a93904df3a6a5baa2752197a0dd3f51a90b699f036b22ccab487.dll,#1
  2⤵
  PID:1200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 548
    3⤵
    - Program crash
    PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1200 -ip 1200
1⤵
PID:4852

memory/1200-133-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download