0b8ff3c6e87fd060057f07eef9a1a91ae6f042ee18ee86ab8c7ba14d61feced7

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2022 04:39

Target

1760-96-0x0000000000280000-0x00000000002AA000-memory.dll
Size

168KB
MD5

071ee7299d174fcedf7b549c53e16910
SHA1

afa01ae8005c0ad5f30ac4855841e5e227696a5a
SHA256

0b8ff3c6e87fd060057f07eef9a1a91ae6f042ee18ee86ab8c7ba14d61feced7
SHA512

ad5f32f31e14e146cd79de23ad833ee08a811498d73d90b51a21486ab3caa73e27202735037bc70de0ab73e524556d2451fbeeadc1d808de9e9bb65eca17ecde
SSDEEP

3072:SgSLOfBP5nXy8ajjp54AmJCIDH3TBf5CgO/ya3v:28tVX3aHp5dmJpDH3TBRCD/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4720 4848 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4720	4848	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4800 wrote to memory of 4848	4800	rundll32.exe	rundll32.exe
PID 4800 wrote to memory of 4848	4800	rundll32.exe	rundll32.exe
PID 4800 wrote to memory of 4848	4800	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1760-96-0x0000000000280000-0x00000000002AA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4800

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1760-96-0x0000000000280000-0x00000000002AA000-memory.dll,#1
2⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 572
3⤵
- Program crash
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4848 -ip 4848
1⤵
PID:4872