11d8a49c65a98e9524c53c12ce07106c0e177d822aa39390d969d2b2c1e374b8

Analysis

max time kernel
67s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2023, 20:20

Target

11d8a49c65a98e9524c53c12ce07106c0e177d822aa39390d969d2b2c1e374b8.dll
Size

168KB
MD5

f15b3edd930a9b34173d402251c7e2ba
SHA1

188584148afa8e6d1337af5bf4447297f156459c
SHA256

11d8a49c65a98e9524c53c12ce07106c0e177d822aa39390d969d2b2c1e374b8
SHA512

5d21b7dff28f2e56afdf5d14e7b792fcbb57c6b5083567ec0b460b2fe1985beb0bd9ad893111fb39773869ad4b33244be1a991262c68dafdf4984f0c90260011
SSDEEP

3072:YfuPlLY1Rd0PL4Fxm1O3Ib+H8XHOdy1lQXVTlNxCqW4oAct/z:Yf0Lps7yO3WU83Zb4VlNxMb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2924	4304	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 4304	2804	rundll32.exe	80
PID 2804 wrote to memory of 4304	2804	rundll32.exe	80
PID 2804 wrote to memory of 4304	2804	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11d8a49c65a98e9524c53c12ce07106c0e177d822aa39390d969d2b2c1e374b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11d8a49c65a98e9524c53c12ce07106c0e177d822aa39390d969d2b2c1e374b8.dll,#1
  2⤵
  PID:4304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 628
    3⤵
    - Program crash
    PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4304 -ip 4304
1⤵
PID:3996

memory/4304-133-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/4304-134-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download