59aa8b7f80826036536acd61965d663bffdab2cbbf6abda6b12bde349d90b7a6

Analysis

max time kernel
62s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2023 00:38

Target

59aa8b7f80826036536acd61965d663bffdab2cbbf6abda6b12bde349d90b7a6.dll
Size

4.0MB
MD5

2fce9f4ab7c3608c6a6df2af165a6c51
SHA1

ffd66193966562e276ba67a8fc3904224030c962
SHA256

59aa8b7f80826036536acd61965d663bffdab2cbbf6abda6b12bde349d90b7a6
SHA512

8a2815950d703ab3b0f0ccb5c6162099bd23fc3fe89ca04f48a609eaf7e314c14f3a9c6eebd2ab2d900e6f03ebebd705787d3d198581f56561b50b7af2098b5a
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzJ:opLDM9RUYqBfO9nP5GIky+f9qLy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4412	4120	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 4120	1640	rundll32.exe	84
PID 1640 wrote to memory of 4120	1640	rundll32.exe	84
PID 1640 wrote to memory of 4120	1640	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59aa8b7f80826036536acd61965d663bffdab2cbbf6abda6b12bde349d90b7a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59aa8b7f80826036536acd61965d663bffdab2cbbf6abda6b12bde349d90b7a6.dll,#1
  2⤵
  PID:4120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 628
    3⤵
    - Program crash
    PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4120 -ip 4120
1⤵
PID:1608

memory/4120-133-0x0000000074940000-0x00000000750F7000-memory.dmp

Filesize
7.7MB

Download