138ddc03dc3ec84727bd1b5c3374d325e373971980e288ecf28366363c83a71d

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2022 19:04

Target

138ddc03dc3ec84727bd1b5c3374d325e373971980e288ecf28366363c83a71d.dll
Size

2.0MB
MD5

bba24aab3e1746f6de73404a1377d8ec
SHA1

d4afbf943b3ede26d2a862d6f71fcde7eb5fc7a9
SHA256

138ddc03dc3ec84727bd1b5c3374d325e373971980e288ecf28366363c83a71d
SHA512

e26f7f5d84261ace5e728f7c418046be22be70b0713a48aa8f42942cdc374d681a560115031a1dad67e1bfafdcf422eb64a333f7ba91d9f87b59346d11db2f46
SSDEEP

49152:4ImzpJJeD1EIDR3WmuDadUuNi/SOmvVfCvG1GyY3:dmzlebmbDadUnKOmcT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4688	4560	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4560	5044	rundll32.exe	81
PID 5044 wrote to memory of 4560	5044	rundll32.exe	81
PID 5044 wrote to memory of 4560	5044	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\138ddc03dc3ec84727bd1b5c3374d325e373971980e288ecf28366363c83a71d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\138ddc03dc3ec84727bd1b5c3374d325e373971980e288ecf28366363c83a71d.dll,#1
  2⤵
  PID:4560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 620
    3⤵
    - Program crash
    PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4560 -ip 4560
1⤵
PID:4764

memory/4560-133-0x0000000010000000-0x00000000102F3000-memory.dmp

Filesize
2.9MB

Download
memory/4560-134-0x0000000077360000-0x0000000077503000-memory.dmp

Filesize
1.6MB

Download
memory/4560-135-0x0000000075220000-0x0000000075435000-memory.dmp

Filesize
2.1MB

Download