3ebc9758d14cac0bd35277ca275c078eba9222784270b19f10da269295ab192c

Analysis

max time kernel
78s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2023, 10:22

Target
3100-135-0x00000000021E0000-0x00000000021ED000-memory.dll
Size 52KB
Sample230308-megldafd28
SHA256 3ebc9758d14cac0bd35277ca275c078eba9222784270b19f10da269295ab192c
MD5 933e139e2413c29e3eab9c4364f9dd9f
SHA1 d434e993f45e45638ceb6d268c11ddb060c41904
SHA512 c990947aaa30dc15076fd799fd1c05eba51c023c0a0935233f764bf9199f871dc91bdf281423681eb3824435543e97b6836bf74aa29c5063863f0581cc322700
SSDEEP 768:5EQAH8qFrgc+QxmjW/I4WIQR7GHzx2WZ23KNech/+Qiqpi6dMhhK3D1Gc:mBcq5+W/ILFRId2Wdhtiq86dMeD1Gc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3368	1348	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1348	1712	rundll32.exe	87
PID 1712 wrote to memory of 1348	1712	rundll32.exe	87
PID 1712 wrote to memory of 1348	1712	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3100-135-0x00000000021E0000-0x00000000021ED000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3100-135-0x00000000021E0000-0x00000000021ED000-memory.dll,#1
  2⤵
  PID:1348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 560
    3⤵
    - Program crash
    PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1348 -ip 1348
1⤵
PID:3496