c23d418ff605240a76a03158e3595f1e09b66ac8817df2b41329f4b94ccebc16

Analysis

max time kernel
85s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2023 10:12

Target

c23d418ff605240a76a03158e3595f1e09b66ac8817df2b41329f4b94ccebc16.dll
Size

393KB
MD5

9210fc8d094ae70c58cfdce6a57720de
SHA1

4eff590916f5956451cbe053bed955936747c1d5
SHA256

c23d418ff605240a76a03158e3595f1e09b66ac8817df2b41329f4b94ccebc16
SHA512

b32f91c3f1f4328316b8c523f08a04f61eebef5b96438580a1caa68c702832897a0792d40d38294eb443d16c64da1ec94c42f07cba4d0587e3ca925c88f9cb47
SSDEEP

12288:xXh6mhXRHGVtRaGwimcXO916kfyJGDkFgXl9htXa:xX4eHcRaGwiw6kgGcgXlDtq

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

460 1996 WerFault.exe rundll32.exe

pid	pid_target	process	target process
460	1996	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2412 wrote to memory of 1996	2412	rundll32.exe	rundll32.exe
PID 2412 wrote to memory of 1996	2412	rundll32.exe	rundll32.exe
PID 2412 wrote to memory of 1996	2412	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c23d418ff605240a76a03158e3595f1e09b66ac8817df2b41329f4b94ccebc16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c23d418ff605240a76a03158e3595f1e09b66ac8817df2b41329f4b94ccebc16.dll,#1
2⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 652
3⤵
- Program crash
PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1996 -ip 1996
1⤵
PID:1988

memory/1996-132-0x0000000000000000-mapping.dmp

Download
memory/1996-133-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/1996-135-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/1996-134-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/1996-136-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download
memory/1996-137-0x0000000000400000-0x00000000004F1000-memory.dmp

Filesize
964KB

Download