2da16568148686c965689e0562bffee4901293f375908bab1fe0aa1ffe37ef3b

Analysis

max time kernel
114s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2023, 20:33

Target

4cb02b804a3561390692f8a4b17524c7fbe4f7ecbbaab5f1949cebee84029a5e.dll
Size

434KB
MD5

13c91cabbee8acee637444a8c079f9b7
SHA1

43e5437109d6d3a6887e8c0644c83faf5b4cc74f
SHA256

4cb02b804a3561390692f8a4b17524c7fbe4f7ecbbaab5f1949cebee84029a5e
SHA512

5642ad5e00a58979a25e97721e5bbfb6924cc1d9ef3f07413f3ce5fe8e86bb9f86041762fedd6da3e9ca28ab0ab98cd9eb883c7ed60c8c5f7568b00c1ed36873
SSDEEP

12288:rJZ701RXT1BaB4Irm8VGf9hyI8K9HGgWA:VZ701RXT1wB4Irz0f9hNS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2252	1336	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1336	1736	rundll32.exe	85
PID 1736 wrote to memory of 1336	1736	rundll32.exe	85
PID 1736 wrote to memory of 1336	1736	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cb02b804a3561390692f8a4b17524c7fbe4f7ecbbaab5f1949cebee84029a5e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4cb02b804a3561390692f8a4b17524c7fbe4f7ecbbaab5f1949cebee84029a5e.dll,#1
  2⤵
  PID:1336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 556
    3⤵
    - Program crash
    PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1336 -ip 1336
1⤵
PID:1268

memory/1336-133-0x000000006B200000-0x000000006B271000-memory.dmp

Filesize
452KB

Download