ac787fded0c32b4c2fdd93648e6e8c5619f1b1b705866ba8ae520bc032a679ad

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2022 10:18

Target

436-97-0x0000000000190000-0x00000000001BA000-memory.dll
Size

168KB
MD5

40e240b717c74a96abaf171f100543aa
SHA1

bc55fb0f68ca46ccbd8ba08161b6bd8fc2855756
SHA256

ac787fded0c32b4c2fdd93648e6e8c5619f1b1b705866ba8ae520bc032a679ad
SHA512

d074847ed0b796869dec4d7c7d7b960a7bbf8a220b3d4c64008d42ddcf21f0b79fb4b03159510bfaff74d8e3209db9b7a3608fc45055b3a04c3e7737cc1b21c5
SSDEEP

3072:ogKraqmkKEgc60s3HC6zBAkJfF1znTBfJAHO/yaoICv:BvkK1LLXCIqkJ91znTBBAu/g

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3052 4888 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3052	4888	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4824 wrote to memory of 4888	4824	rundll32.exe	rundll32.exe
PID 4824 wrote to memory of 4888	4824	rundll32.exe	rundll32.exe
PID 4824 wrote to memory of 4888	4824	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\436-97-0x0000000000190000-0x00000000001BA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\436-97-0x0000000000190000-0x00000000001BA000-memory.dll,#1
2⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 560
3⤵
- Program crash
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4888 -ip 4888
1⤵
PID:680