fac5e5123471f6a54b79906c60605dd04688adc8a41bb0bda88da322a1fbc27a

Analysis

max time kernel
90s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2023, 01:46

Target

fac5e5123471f6a54b79906c60605dd04688adc8a41bb0bda88da322a1fbc27a.dll
Size

3.6MB
MD5

ce7578f4b04478e3800cd3cef1a04ebc
SHA1

ddfa274bd12b0ccb29f7e2b5e5d87ac1d963fa82
SHA256

fac5e5123471f6a54b79906c60605dd04688adc8a41bb0bda88da322a1fbc27a
SHA512

3aa06d91098c2e1885d49a6d62b479285c17b86965191de083ee68c27899962b5a361fb1b3a7ab929596d958f09827c288c2bfb7c5fe492000a1071b34db2fcc
SSDEEP

98304:pKj5h013iyOTC181lFH3r9kOViB9iYSa:pKthxvsUldr9ABpD

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
388	4540	WerFault.exe	81
1352	4540	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4540	rundll32.exe
4540	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 4540	5028	rundll32.exe	81
PID 5028 wrote to memory of 4540	5028	rundll32.exe	81
PID 5028 wrote to memory of 4540	5028	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fac5e5123471f6a54b79906c60605dd04688adc8a41bb0bda88da322a1fbc27a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fac5e5123471f6a54b79906c60605dd04688adc8a41bb0bda88da322a1fbc27a.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 620
    3⤵
    - Program crash
    PID:388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 580
    3⤵
    - Program crash
    PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4540 -ip 4540
1⤵
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4540 -ip 4540
1⤵
PID:396

memory/4540-136-0x0000000074C40000-0x0000000075467000-memory.dmp

Filesize
8.2MB

Download
memory/4540-139-0x0000000074C40000-0x0000000075467000-memory.dmp

Filesize
8.2MB

Download