52de820bdf87558e54aa7f4490be1782959dcc89a30f551c1bcc7d9738740e39

Analysis

max time kernel
78s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2023, 08:46

Target
2560-135-0x00000000006B0000-0x00000000006BD000-memory.dll
Size 52KB
Sample230322-kpqwpafh33
SHA256 52de820bdf87558e54aa7f4490be1782959dcc89a30f551c1bcc7d9738740e39
MD5 19f6ae3c65b60dcfc9c6bb4dcdfd7df1
SHA1 7c773c455a1b8c493748fc080dddf845ad244618
SHA512 55b5f2198268442fc08bd428b57998e09e45a0ea5ad0c7e9e4604ba9c6527c1d2d5c4f75482ff7e8141aabe44e1e257111abe9480256715cc1d62243dcdd2d15
SSDEEP 768:wHcnq3+4xmsEF/I4/cAGHcqT8+3ypw7UPbXdiBdMhhK3D1Gc0B:w8nqO7F/IecVrTEpPbXwBdMeD1GcM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2620	1336	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1336	2136	rundll32.exe	81
PID 2136 wrote to memory of 1336	2136	rundll32.exe	81
PID 2136 wrote to memory of 1336	2136	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2560-135-0x00000000006B0000-0x00000000006BD000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2560-135-0x00000000006B0000-0x00000000006BD000-memory.dll,#1
  2⤵
  PID:1336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 560
    3⤵
    - Program crash
    PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1336 -ip 1336
1⤵
PID:4680