6e26ba01c80ccf6ce3618d9fa3c7b3b9c06a327974dc735b098e3d3a20880993

Analysis

max time kernel
62s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2023 23:53

Target

6e26ba01c80ccf6ce3618d9fa3c7b3b9c06a327974dc735b098e3d3a20880993.dll
Size

4.0MB
MD5

adaac4ae7bf19e9d435fc5e23611fe0c
SHA1

cf3ffeefcfddde5f6e5dbdb7588a19e4e02c846a
SHA256

6e26ba01c80ccf6ce3618d9fa3c7b3b9c06a327974dc735b098e3d3a20880993
SHA512

cfb7b00c9044a284a7387f675216a7cb22499742b9bd11c2c574203c7aa19fcf61471ad82dedb3b796ec178247bbf216494012a0a117c5915cc52a908411689b
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzE:opLDM9RUYqBfO9nP5GIky+f9qL/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1036	1724	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1724	2192	rundll32.exe	84
PID 2192 wrote to memory of 1724	2192	rundll32.exe	84
PID 2192 wrote to memory of 1724	2192	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e26ba01c80ccf6ce3618d9fa3c7b3b9c06a327974dc735b098e3d3a20880993.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6e26ba01c80ccf6ce3618d9fa3c7b3b9c06a327974dc735b098e3d3a20880993.dll,#1
  2⤵
  PID:1724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 628
    3⤵
    - Program crash
    PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1724 -ip 1724
1⤵
PID:1268

memory/1724-133-0x00000000741C0000-0x0000000074977000-memory.dmp

Filesize
7.7MB

Download