36c92e31b0f996b18ccb3fc6a8890d64cb8f159b689b4eb008cda58e2f96135a

Analysis

max time kernel
156s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2023, 05:31

Target

36c92e31b0f996b18ccb3fc6a8890d64cb8f159b689b4eb008cda58e2f96135a.dll
Size

4.0MB
MD5

c19c7b8f7145b562bdb6df34b7524bea
SHA1

88e1662ac19532dc92fe0ca04b7d4285cba74092
SHA256

36c92e31b0f996b18ccb3fc6a8890d64cb8f159b689b4eb008cda58e2f96135a
SHA512

3d6bef306143e4a97b926660748d0ce7dfb73ef9347c49f53f40eb1d7476fdec28291763629d937e899b277f1b4d7b0d1e2893106c54b4ab5e579002ab2ab77b
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzY:opLDM9RUYqBfO9nP5GIky+f9qLT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3640	5012	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 5012	4124	rundll32.exe	82
PID 4124 wrote to memory of 5012	4124	rundll32.exe	82
PID 4124 wrote to memory of 5012	4124	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36c92e31b0f996b18ccb3fc6a8890d64cb8f159b689b4eb008cda58e2f96135a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36c92e31b0f996b18ccb3fc6a8890d64cb8f159b689b4eb008cda58e2f96135a.dll,#1
  2⤵
  PID:5012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 628
    3⤵
    - Program crash
    PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5012 -ip 5012
1⤵
PID:1652

memory/5012-133-0x0000000074C80000-0x0000000075437000-memory.dmp

Filesize
7.7MB

Download