bf2f85b0fa41c19f13cedfb4513e47f4e1c3d5ba31a4d7132d881c9b22509098

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2022 03:49

Target

bf2f85b0fa41c19f13cedfb4513e47f4e1c3d5ba31a4d7132d881c9b22509098.dll
Size

198KB
MD5

4a92b2ae59625bea75567bf84e315726
SHA1

9a701ed1e10ff24edbc268bd3ab20b7b0722a17b
SHA256

bf2f85b0fa41c19f13cedfb4513e47f4e1c3d5ba31a4d7132d881c9b22509098
SHA512

ab93b00429d0a9ddd771df40a00b95ba1bc3f97407e14fc36c0a9e49fd21596b37e83647008850cbf836cc4566b947eda39d8533566a75d76bf1720a0d24864b
SSDEEP

3072:Dl1+XuWoafiOFKM4/0ZZF8Cuz7qtjPkbPIc7tPfCV5yiFblcW:Dz5af5UN/0ZZJuKjPNi3YPcW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3644	2356	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2356	2288	rundll32.exe	78
PID 2288 wrote to memory of 2356	2288	rundll32.exe	78
PID 2288 wrote to memory of 2356	2288	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf2f85b0fa41c19f13cedfb4513e47f4e1c3d5ba31a4d7132d881c9b22509098.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf2f85b0fa41c19f13cedfb4513e47f4e1c3d5ba31a4d7132d881c9b22509098.dll,#1
  2⤵
  PID:2356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 564
    3⤵
    - Program crash
    PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2356 -ip 2356
1⤵
PID:2400

memory/2356-133-0x00000000025A0000-0x00000000025A9000-memory.dmp

Filesize
36KB

Download