8add857dfc19d6efbe0a34955f6b01a9b78c69c0720e4b67f49c0d7a91a3ba15

Analysis

max time kernel
91s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2022, 02:20

Target

4524-147-0x00000000021E0000-0x0000000002275000-memory.dll
Size

596KB
MD5

1d392cea60039d646a0c827de1d90261
SHA1

b65c5fb4d0a8e221e6b604ae570798e95ca97491
SHA256

8add857dfc19d6efbe0a34955f6b01a9b78c69c0720e4b67f49c0d7a91a3ba15
SHA512

b29a957f531c08a73511a28e8b1f2b202bbf6dc651fe64b4e0f26658f304e5d4de5531fcbbfc5e64d24c8a862dcc2a80e8a182d9cb8ecb70b7c47f79f905bff3
SSDEEP

768:L2Hhn3rXzv9ywyV34OB9bl5n+iRjn9P1avZa9Bmr1h097mI5:shn3zxjyt5+0zavZangX097m

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4800	1608	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1608	2096	rundll32.exe	81
PID 2096 wrote to memory of 1608	2096	rundll32.exe	81
PID 2096 wrote to memory of 1608	2096	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4524-147-0x00000000021E0000-0x0000000002275000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4524-147-0x00000000021E0000-0x0000000002275000-memory.dll,#1
  2⤵
  PID:1608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 560
    3⤵
    - Program crash
    PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1608 -ip 1608
1⤵
PID:4488