b0e9693b49669a9b1e56fc33824642a8789469906455b2bdb03d50c186938c44

Analysis

max time kernel
60s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2022, 14:04

Target

3372-140-0x0000000000400000-0x0000000000495000-memory.dll
Size

596KB
MD5

acd0fc91e0c24024bf14bdd2b0b76361
SHA1

b3a857f0dd3ad9a7acb867d7a9eaf93a74c89bdb
SHA256

b0e9693b49669a9b1e56fc33824642a8789469906455b2bdb03d50c186938c44
SHA512

c52f5fdc2a83bff237dc75e9bd4055531540a675aa85750263b481e3279a97c3d73af3a3f2a51effac5dd21a4755dd01845d8cb7b04a0e75efacd5a11d0737e3
SSDEEP

768:L2HRfxRHbvvpywyV34OB9bl5n+iRjn9P1avZa9Bmr1h097mI5:kRfxR7Zjyt5+0zavZangX097m

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4540	3472	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 3472	1144	rundll32.exe	80
PID 1144 wrote to memory of 3472	1144	rundll32.exe	80
PID 1144 wrote to memory of 3472	1144	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3372-140-0x0000000000400000-0x0000000000495000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3372-140-0x0000000000400000-0x0000000000495000-memory.dll,#1
  2⤵
  PID:3472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 564
    3⤵
    - Program crash
    PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3472 -ip 3472
1⤵
PID:4176