871598b9007f599b43a1abf255f950b63e6765685ae3d45756bf05fa82e337b1

Analysis

max time kernel
105s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2023 06:53

Target

871598b9007f599b43a1abf255f950b63e6765685ae3d45756bf05fa82e337b1.dll
Size

201KB
MD5

77099bbd1007b7f819a7e1289194aeaf
SHA1

00cfcfd799a3d94b8705af082693b23da7d97afb
SHA256

871598b9007f599b43a1abf255f950b63e6765685ae3d45756bf05fa82e337b1
SHA512

1b7d75a2b76c1e0eecd0c969d32c6119eff3ad3aa3325d8208d3b8e029c70bae835c023ba38c1f4215f5ecfa979d348d6e9271b0a753b1e1c2a928cf06ae6b2c
SSDEEP

3072:Ya9hHwjrCHZaOLZL/WlY5HI85pkzYBIlRDCNDPOx3Q0dEEaO2AL5bnIDQ8vzR4:Ya9haCN7kY6L4qg0OO2QnCza

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2456 1968 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2456	1968	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1764 wrote to memory of 1968	1764	rundll32.exe	rundll32.exe
PID 1764 wrote to memory of 1968	1764	rundll32.exe	rundll32.exe
PID 1764 wrote to memory of 1968	1764	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\871598b9007f599b43a1abf255f950b63e6765685ae3d45756bf05fa82e337b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\871598b9007f599b43a1abf255f950b63e6765685ae3d45756bf05fa82e337b1.dll,#1
2⤵
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 664
3⤵
- Program crash
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1968 -ip 1968
1⤵
PID:1304

memory/1968-133-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download
memory/1968-134-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download
memory/1968-135-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download
memory/1968-136-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download
memory/1968-137-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download