2b6f3e7762fbe63d6b6f104c4936b2fdfa455a65c1ef0c5ddfdaba7596ad8fdb

Analysis

max time kernel
106s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2023, 18:11

Target
2008-56-0x00000000002C0000-0x00000000002CD000-memory.dll
Size 52KB
Sample230306-wsla6aee34
SHA256 2b6f3e7762fbe63d6b6f104c4936b2fdfa455a65c1ef0c5ddfdaba7596ad8fdb
MD5 13cbe5cd31ce3da486b4d6dc682cbe8c
SHA1 4001109557fec6dbc931c9f1a0d9736c9abe2ed1
SHA512 b780202a98a9a62375c3eba92539bfe1c08dcfb317479b1325cf926118f92f433b5a9b9ca978973fbc9510941d9c0e3801ea68e9a780081620f381eeb0ea45d7
SSDEEP 1536:mxQq9uu/oEkb1LOVSxM5hm6IbcdMKD1Gc4d:rqje1iVSxMuudMU1G9d
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1180	464	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 464	4316	rundll32.exe	85
PID 4316 wrote to memory of 464	4316	rundll32.exe	85
PID 4316 wrote to memory of 464	4316	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2008-56-0x00000000002C0000-0x00000000002CD000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2008-56-0x00000000002C0000-0x00000000002CD000-memory.dll,#1
  2⤵
  PID:464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 564
    3⤵
    - Program crash
    PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 464 -ip 464
1⤵
PID:4112