1e2b05838edfb0460fc97e2d7bab2271891c55ca0c895d4db30cf2acfaea51d2

Analysis

max time kernel
122s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2023, 12:49

Target

1e2b05838edfb0460fc97e2d7bab2271891c55ca0c895d4db30cf2acfaea51d2.dll
Size

37KB
MD5

53cfc99ee275af52e9dde06292083879
SHA1

a3ad99efaa4c896976e3861fd5b8ec173bb10228
SHA256

1e2b05838edfb0460fc97e2d7bab2271891c55ca0c895d4db30cf2acfaea51d2
SHA512

f881dd32db969374bf45a6b13b526b5f8bfe7aeb9d395f9e6fcc19076173a578348354814d6688153be24d78eaea8ca2549dd64abf6128f39dc921f36b9899ae
SSDEEP

384:lz698uLGPWE/8azdJkX3aqPBr0frtMFpRrEVhUXMWlPK+1nu6EDHd7E/12C7vyxM:3X8aiKfhe3OhjyimnTEDW7vydv8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
392	436	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 436	1528	rundll32.exe	86
PID 1528 wrote to memory of 436	1528	rundll32.exe	86
PID 1528 wrote to memory of 436	1528	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e2b05838edfb0460fc97e2d7bab2271891c55ca0c895d4db30cf2acfaea51d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e2b05838edfb0460fc97e2d7bab2271891c55ca0c895d4db30cf2acfaea51d2.dll,#1
  2⤵
  PID:436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 600
    3⤵
    - Program crash
    PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 436 -ip 436
1⤵
PID:1000

memory/436-133-0x0000000075020000-0x000000007502D000-memory.dmp

Filesize
52KB

Download