50b141a77a6d7aee8bd9fe7f57aae3c22686b6ce30a43c524e95f304720fd8a2

Analysis

max time kernel
133s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2022 11:43

Target

1252-95-0x0000000000490000-0x00000000004BA000-memory.dll
Size

168KB
MD5

75fda09c4e480fc88aef6d3d1a7f0139
SHA1

b67c0affdbcf75426eb05ced272cfc28706aba16
SHA256

50b141a77a6d7aee8bd9fe7f57aae3c22686b6ce30a43c524e95f304720fd8a2
SHA512

b73cd262f3d3b21eb1075046ed1c7892540daa5549ec2865f962d0a5ac5d4cc805b28b6cb0c5a2e2a8de65b329b44a67b1dcbfb09b89454202c0a19b08bc534d
SSDEEP

3072:ogqbq660Q8ab2YnS4xAd2JP1VJHTBfJghO/yapv:BT1LbXS46d2JdVJHTBBg4/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4444 5068 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4444	5068	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1680 wrote to memory of 5068	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 5068	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 5068	1680	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1252-95-0x0000000000490000-0x00000000004BA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1252-95-0x0000000000490000-0x00000000004BA000-memory.dll,#1
2⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 560
3⤵
- Program crash
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5068 -ip 5068
1⤵
PID:3744