02900e6eb7511f87d7e8de75f13d63d01f772702f0f4b989b2161a0723e06892

Analysis

max time kernel
168s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2022 01:08

Target

992-94-0x00000000001E0000-0x000000000020A000-memory.dll
Size

168KB
MD5

636eb8f7f01dc41aa3a5068f7650b378
SHA1

43813f29575b5bde2d2b188726f04f96f3215bd3
SHA256

02900e6eb7511f87d7e8de75f13d63d01f772702f0f4b989b2161a0723e06892
SHA512

0ea7675992be959d6c5fea95c529485d93d94dd4a11b23817fa888752f60dd875c01dc9e25674d7f2ddb487d2303423393fda152e4607fa11fc1105a999b64b1
SSDEEP

3072:egcnehhT9XxeQQ7bP9BOAmJce3gLTBfNeSO/yaoICv:h7phnQXP9B7mJR3gLTBFet/g

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5068 2620 WerFault.exe rundll32.exe

pid	pid_target	process	target process
5068	2620	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2584 wrote to memory of 2620	2584	rundll32.exe	rundll32.exe
PID 2584 wrote to memory of 2620	2584	rundll32.exe	rundll32.exe
PID 2584 wrote to memory of 2620	2584	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\992-94-0x00000000001E0000-0x000000000020A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2584

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\992-94-0x00000000001E0000-0x000000000020A000-memory.dll,#1
2⤵
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 560
3⤵
- Program crash
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2620 -ip 2620
1⤵
PID:5112