9f2944e822916b8a563c89828d0243d2598a8b17b20d152ff93eacde5b2ee7c1

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2023, 23:23

Target

9f2944e822916b8a563c89828d0243d2598a8b17b20d152ff93eacde5b2ee7c1.dll
Size

4.0MB
MD5

0c1b70cab75fe8561e95e2a33ea76c4e
SHA1

3e902320ff44fd40c3c593f03175b0036e05ade8
SHA256

9f2944e822916b8a563c89828d0243d2598a8b17b20d152ff93eacde5b2ee7c1
SHA512

2cb5b2c5d85d8e425724ab3c3992248e5712c769b3ccafc1ee0e8803f2177f2c92a1393b0a259a0f82965d109a016d31a918eb13de9edb95d8e7326a39f284b2
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGz3:opLDM9RUYqBfO9nP5GIky+f9qLE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2964	2572	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 2572	956	rundll32.exe	82
PID 956 wrote to memory of 2572	956	rundll32.exe	82
PID 956 wrote to memory of 2572	956	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f2944e822916b8a563c89828d0243d2598a8b17b20d152ff93eacde5b2ee7c1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f2944e822916b8a563c89828d0243d2598a8b17b20d152ff93eacde5b2ee7c1.dll,#1
  2⤵
  PID:2572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 628
    3⤵
    - Program crash
    PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2572 -ip 2572
1⤵
PID:1380

memory/2572-133-0x00000000746C0000-0x0000000074E77000-memory.dmp

Filesize
7.7MB

Download