41c247abac930ec31edee870c82685a58611e8abbaa7b2bab20e7cac606f6261

Analysis

max time kernel
82s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2023, 13:21

Target

1324-56-0x0000000000170000-0x0000000000191000-memory.dll
Size

132KB
MD5

bb41e0cb67c7e7b7766a5032e91d4fd9
SHA1

00a0c50ea5ac0cf88f1da084c31aa144b29d6922
SHA256

41c247abac930ec31edee870c82685a58611e8abbaa7b2bab20e7cac606f6261
SHA512

cef856b1cb228f6db6ad2cb35919948e43c6ef73ec5bdff395230f9c96717b6c704c70e70fec1b26c124457181851071fcf88eeb39df3139bc48908b7b00458b
SSDEEP

768:92wo1LNxxkYmi4vxYyLcaT0LrqH6EHV9HmDXhVp/s6zTgMlbDlxKWAb214:lo1LNx6Ym66zmHG9HCx/jzTtbBxKY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3868	1844	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1844	1764	rundll32.exe	86
PID 1764 wrote to memory of 1844	1764	rundll32.exe	86
PID 1764 wrote to memory of 1844	1764	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1324-56-0x0000000000170000-0x0000000000191000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1324-56-0x0000000000170000-0x0000000000191000-memory.dll,#1
  2⤵
  PID:1844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 560
    3⤵
    - Program crash
    PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1844 -ip 1844
1⤵
PID:4184