e8bf04060930c079b23d7e221fab7876fd737c0c5d51cb4add878f07be47307f

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2023, 12:35

Target

2584-135-0x0000000002D80000-0x0000000002D8D000-memory.dll
Size

52KB
MD5

35784e4148c8123ab6350fd547f707cb
SHA1

ab1328ef32d64d4c0280ccec867e18c102b54e91
SHA256

e8bf04060930c079b23d7e221fab7876fd737c0c5d51cb4add878f07be47307f
SHA512

684647f697e1047006f3b8ae97f9b13620e16df9da0f00f9e1f298f219fa7d7f96db255188716efbdc48496fd526f80dfda9e1b93027d0dab2c45595cbc126e9
SSDEEP

768:p8W4k2qVDnskVGtk/E43YCst5+H5LIISOvwUZEYvUIlOKdMxhK3D1Gc:p8WV2qRqk/EmY7wpIgN8IAKdMOD1Gc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3932	372	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 372	2136	rundll32.exe	85
PID 2136 wrote to memory of 372	2136	rundll32.exe	85
PID 2136 wrote to memory of 372	2136	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2584-135-0x0000000002D80000-0x0000000002D8D000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2584-135-0x0000000002D80000-0x0000000002D8D000-memory.dll,#1
  2⤵
  PID:372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 564
    3⤵
    - Program crash
    PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 372 -ip 372
1⤵
PID:3920