84e988d939f420700d8b1a948ef32abcdbb1bf99e726583d61cb9230110a764f

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2023, 08:46

Target

84e988d939f420700d8b1a948ef32abcdbb1bf99e726583d61cb9230110a764f.dll
Size

97KB
MD5

fa5f2aaec665d7fa94eb74978ab6460f
SHA1

b5995ee998e459583342424d3dc36ca516d6d203
SHA256

84e988d939f420700d8b1a948ef32abcdbb1bf99e726583d61cb9230110a764f
SHA512

8d4163470fad6bfa9d74e040b8fa1f0c563282e2d0a37e11b688f925d6542cb840270f1b1fdd1f2087e8951fd2e971e7caa5727b9200c759c2a20ce52a30273d
SSDEEP

3072:RAUezDZb+otCBhmt+cSfxaTYckPxiT3w:SUED

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4648	4192	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4192	rundll32.exe
4192	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4192	5064	rundll32.exe	81
PID 5064 wrote to memory of 4192	5064	rundll32.exe	81
PID 5064 wrote to memory of 4192	5064	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84e988d939f420700d8b1a948ef32abcdbb1bf99e726583d61cb9230110a764f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\84e988d939f420700d8b1a948ef32abcdbb1bf99e726583d61cb9230110a764f.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 608
    3⤵
    - Program crash
    PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4192 -ip 4192
1⤵
PID:3004

memory/4192-133-0x0000000075500000-0x000000007552F000-memory.dmp

Filesize
188KB

Download
memory/4192-134-0x0000000075500000-0x000000007552F000-memory.dmp

Filesize
188KB

Download
memory/4192-135-0x0000000075500000-0x000000007552F000-memory.dmp

Filesize
188KB

Download