75313626730678ba9d5b90ce3c41acdecc24b5f8e3c659e891243dfe4d00dfad

Analysis

max time kernel
84s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2023 06:30

Target

75313626730678ba9d5b90ce3c41acdecc24b5f8e3c659e891243dfe4d00dfad.dll
Size

4.0MB
MD5

b1d287fafd700fb1b50ee060e15ebe0d
SHA1

a1e56c9d7fc2282fac33e8e7a053f879254b0dc0
SHA256

75313626730678ba9d5b90ce3c41acdecc24b5f8e3c659e891243dfe4d00dfad
SHA512

e3d39a55cd9b18b392dd169843bd9f0b3d69615bbf697cc51f265b52e5a7a602d0916edd8fdbd05beaef960b903ed8e7cd20fc0ea0bed194a443a3a8891e48c1
SSDEEP

98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzm:opLDM9RUYqBfO9nP5GIky+f9qLN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4552	4716	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 4716	1468	rundll32.exe	82
PID 1468 wrote to memory of 4716	1468	rundll32.exe	82
PID 1468 wrote to memory of 4716	1468	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\75313626730678ba9d5b90ce3c41acdecc24b5f8e3c659e891243dfe4d00dfad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\75313626730678ba9d5b90ce3c41acdecc24b5f8e3c659e891243dfe4d00dfad.dll,#1
  2⤵
  PID:4716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 632
    3⤵
    - Program crash
    PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4716 -ip 4716
1⤵
PID:2156

memory/4716-133-0x0000000074F80000-0x0000000075737000-memory.dmp

Filesize
7.7MB

Download