b5496071a575311863ec52e2eee66bf05b49c13d8d0ccf83f9fa0ea28654d675

Analysis

max time kernel
99s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2023 20:44

Target

f595c83297ca404eef1f62aade30c4a1c96cf6bdf12d5221130f362b84472b81.dll
Size

434KB
MD5

a6251c747b3f34868ff21db41209d4a6
SHA1

d8cf975125fe9df61436821dcb4003780fc89730
SHA256

f595c83297ca404eef1f62aade30c4a1c96cf6bdf12d5221130f362b84472b81
SHA512

29a20ff744550a5047171fd9f1030e2a21c0f3d97cca64761d6fc942159c8c88e901e0c24ab00c5a02fa905100ad8f2f5a15d6578e85b507f28add006353304c
SSDEEP

12288:rJZ701RXT1BaB4Irm8VGf9hyI8K9HGgHA:VZ701RXT1wB4Irz0f9hNb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	1524	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 1524	392	rundll32.exe	85
PID 392 wrote to memory of 1524	392	rundll32.exe	85
PID 392 wrote to memory of 1524	392	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f595c83297ca404eef1f62aade30c4a1c96cf6bdf12d5221130f362b84472b81.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f595c83297ca404eef1f62aade30c4a1c96cf6bdf12d5221130f362b84472b81.dll,#1
  2⤵
  PID:1524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 608
    3⤵
    - Program crash
    PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1524 -ip 1524
1⤵
PID:3416

memory/1524-133-0x000000006B200000-0x000000006B271000-memory.dmp

Filesize
452KB

Download