c98101b47ca30554f9fa784ecdf3c6cab12cf8265e561608dea5d0e633b1b4f2

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2023, 03:08

Target

c98101b47ca30554f9fa784ecdf3c6cab12cf8265e561608dea5d0e633b1b4f2.dll
Size

4.0MB
MD5

e3e6ddcb3aedf6a116107060e77d2d8d
SHA1

841fb5e9a7b3dcd8021c97cbb544a821277aec47
SHA256

c98101b47ca30554f9fa784ecdf3c6cab12cf8265e561608dea5d0e633b1b4f2
SHA512

a3f08b80ade6db10361776f882ec44bc8e934244c1f7410824192425ed12829c19059bcd49e08e2976e14ec4c51c49d7b21bbf809d9618d294a84ab068c70f12
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzp:opLDM9RUYqBfO9nP5GIky+f9qLS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3128	3272	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 3272	400	rundll32.exe	84
PID 400 wrote to memory of 3272	400	rundll32.exe	84
PID 400 wrote to memory of 3272	400	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c98101b47ca30554f9fa784ecdf3c6cab12cf8265e561608dea5d0e633b1b4f2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c98101b47ca30554f9fa784ecdf3c6cab12cf8265e561608dea5d0e633b1b4f2.dll,#1
  2⤵
  PID:3272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 628
    3⤵
    - Program crash
    PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3272 -ip 3272
1⤵
PID:3600

memory/3272-133-0x0000000074980000-0x0000000075137000-memory.dmp

Filesize
7.7MB

Download