11ab6fd1697525181c6ceac1232e80b9c36ddf44f0df96ddd7921bcb5172e57e

Analysis

max time kernel
65s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2023 19:47

Target

11ab6fd1697525181c6ceac1232e80b9c36ddf44f0df96ddd7921bcb5172e57e.dll
Size

170KB
MD5

2d63fa2cb2aeb06ed0c1d748c29962cd
SHA1

9911e414f09e4cf3939356b6e85f9d9fcbd68adf
SHA256

11ab6fd1697525181c6ceac1232e80b9c36ddf44f0df96ddd7921bcb5172e57e
SHA512

d83e43187b62a98057f1afb13ba7041f488f66e1608c7092c773d6138ebdfcf36b54e3a48d6bc65178f84e6e0a675b2c74b7f823e62b876930af4932545fa985
SSDEEP

3072:j/OJcXyZH+ZLa+W1icfTrYZwfr3rkw3HdQR8hVlkddWrD:zC9+daj/QAr3wOCeVkGr

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4488 4116 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4488	4116	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4400 wrote to memory of 4116	4400	rundll32.exe	rundll32.exe
PID 4400 wrote to memory of 4116	4400	rundll32.exe	rundll32.exe
PID 4400 wrote to memory of 4116	4400	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11ab6fd1697525181c6ceac1232e80b9c36ddf44f0df96ddd7921bcb5172e57e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4400

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11ab6fd1697525181c6ceac1232e80b9c36ddf44f0df96ddd7921bcb5172e57e.dll,#1
2⤵
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 728
3⤵
- Program crash
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4116 -ip 4116
1⤵
PID:4480

memory/4116-133-0x0000000000D20000-0x0000000000D85000-memory.dmp

Filesize
404KB

Download
memory/4116-134-0x0000000000D20000-0x0000000000D85000-memory.dmp

Filesize
404KB

Download
memory/4116-135-0x0000000000D20000-0x0000000000D85000-memory.dmp

Filesize
404KB

Download