ac8ab1f5f43ae1e26abd74c7362c09a0677b41bb89f2623c22a9b1190751fdf9

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16/12/2022, 05:31

Target

1532-57-0x0000000000200000-0x000000000022A000-memory.dll
Size

168KB
MD5

1a05592e045af77cbd4a6fa0c0988ff1
SHA1

a0266ecfe34f963de0f0ea3a59a855bd5cbaa30d
SHA256

ac8ab1f5f43ae1e26abd74c7362c09a0677b41bb89f2623c22a9b1190751fdf9
SHA512

0cfeb68b8c691badf9f9613a119e329afe4173b37a8115065d4c815cfe803ea87e0923f18ae6bdf3c17a7012969e94b33068f31167bb03dff036c791f817f0c3
SSDEEP

3072:SgiSH5HRFVScyzTBxwAWJKwTZnTBfZyeO/yaAv:FdrVXyXBxFWJpTZnTBxyB/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4856	4912	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 4912	4200	rundll32.exe	81
PID 4200 wrote to memory of 4912	4200	rundll32.exe	81
PID 4200 wrote to memory of 4912	4200	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1532-57-0x0000000000200000-0x000000000022A000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1532-57-0x0000000000200000-0x000000000022A000-memory.dll,#1
  2⤵
  PID:4912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 560
    3⤵
    - Program crash
    PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4912 -ip 4912
1⤵
PID:5072