e7901ae133af75e7e23ee9ef5e6af4dc87f7fbc90c9079a57e0146b519ea063e

Analysis

max time kernel
121s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2023, 20:40

Target

16859077ca8ac1b4b0b16b5df76fe391672dae77244aa1f9282dcb87643d909f.dll
Size

434KB
MD5

20efd81f294e0ef2bc3c9e8c4059a052
SHA1

b02cd6861d945fa5cdeaa4bf07c6c7fbc8d4d134
SHA256

16859077ca8ac1b4b0b16b5df76fe391672dae77244aa1f9282dcb87643d909f
SHA512

ed3403343bdc80c82b2e92fad591616bd94ab45660b1f187216109b15c170a213f739fee01574f9e5f495d4dac8b8026e28996f578633f01574b7adbcc80340b
SSDEEP

12288:rJZ701RXT1BaB4Irm8VGf9hyI8K9HGg+A:VZ701RXT1wB4Irz0f9hNq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3700	1300	WerFault.exe	71

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1300	1184	rundll32.exe	71
PID 1184 wrote to memory of 1300	1184	rundll32.exe	71
PID 1184 wrote to memory of 1300	1184	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16859077ca8ac1b4b0b16b5df76fe391672dae77244aa1f9282dcb87643d909f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16859077ca8ac1b4b0b16b5df76fe391672dae77244aa1f9282dcb87643d909f.dll,#1
  2⤵
  PID:1300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 600
    3⤵
    - Program crash
    PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1300 -ip 1300
1⤵
PID:2452

memory/1300-133-0x000000006B200000-0x000000006B271000-memory.dmp

Filesize
452KB

Download