d5cc641f922ab7e2c68231c3d8696c450132e9a2874076fc0669bab1eac54de1

Analysis

max time kernel
60s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2022 02:14

Target

1756-56-0x00000000001C0000-0x00000000001EA000-memory.dll
Size

168KB
MD5

0feaeda6f0759e961596fd7cc32404e3
SHA1

3dd36130bd26d6170141383d5c2e017dbbf4f222
SHA256

d5cc641f922ab7e2c68231c3d8696c450132e9a2874076fc0669bab1eac54de1
SHA512

2ba469b3189aaabd3a64d37981e06e5af7fb98267af01f6f6e98aef6f662dbc75b36c833cf0aa19071a48d954ffd9070690bbaac89729ff60d818edde95b3ca3
SSDEEP

3072:CgquZd7BbtzKk2z7VqgMAWJ+UrIXTBf5qtO/ya1v:nd7R532/VqgJWJBrIXTBRq8/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1960 2188 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1960	2188	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1224 wrote to memory of 2188	1224	rundll32.exe	rundll32.exe
PID 1224 wrote to memory of 2188	1224	rundll32.exe	rundll32.exe
PID 1224 wrote to memory of 2188	1224	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1756-56-0x00000000001C0000-0x00000000001EA000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1756-56-0x00000000001C0000-0x00000000001EA000-memory.dll,#1
2⤵
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 560
3⤵
- Program crash
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2188 -ip 2188
1⤵
PID:2356