9919791ec9bcb0a83cb6ecad072ee876ab43fbbd334b7bce21d6500edb2fbada

Analysis

max time kernel
61s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2023, 20:01

Target

9919791ec9bcb0a83cb6ecad072ee876ab43fbbd334b7bce21d6500edb2fbada.dll
Size

161KB
MD5

f64d275cedc4958495357390f4e025d4
SHA1

167b72a28b33e4c400ef117a5b6ead3777b6071e
SHA256

9919791ec9bcb0a83cb6ecad072ee876ab43fbbd334b7bce21d6500edb2fbada
SHA512

7c2af2764339cdf9668068bad3f94324756f26f20e8db8933be539efb4bb228a69ff24e6a16d8466e72a20116f2ab5ea5a57074933d0fd6f294c4062ef1cb1eb
SSDEEP

3072:5T64VoI67r1d8eLlvJ9YTBj1BQEauAbV+tEn5J/NRsgCX/X/amtT:5T6tdd8klfYVXQwAbln52lXn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4112	4900	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4900	4860	rundll32.exe	81
PID 4860 wrote to memory of 4900	4860	rundll32.exe	81
PID 4860 wrote to memory of 4900	4860	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9919791ec9bcb0a83cb6ecad072ee876ab43fbbd334b7bce21d6500edb2fbada.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9919791ec9bcb0a83cb6ecad072ee876ab43fbbd334b7bce21d6500edb2fbada.dll,#1
  2⤵
  PID:4900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 696
    3⤵
    - Program crash
    PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4900 -ip 4900
1⤵
PID:948

memory/4900-133-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download
memory/4900-134-0x0000000010000000-0x0000000010060000-memory.dmp

Filesize
384KB

Download