70dc67ebdf53c8a58f19a648460121908b6deba8d6e6afa07736b562c6a160fd

Analysis

max time kernel
91s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2023, 11:07

Target

70dc67ebdf53c8a58f19a648460121908b6deba8d6e6afa07736b562c6a160fd.dll
Size

264KB
MD5

f5149dcbe720264e1b7cc0ef7b01d10b
SHA1

f1bf416c5fe97e86f71176e7f85e73f10159cd7c
SHA256

70dc67ebdf53c8a58f19a648460121908b6deba8d6e6afa07736b562c6a160fd
SHA512

92a11477c302b302db56980c5194d0bbf5e6a51e25011681b854c8d9e1e135a92db247e9af98bcf7d2db85eef06c1cdac428a34cf649f87fef92fd3a5d9c5b8b
SSDEEP

6144:PYOZWS+1lg9jJpHrB7bDYuAsUhZkooooH1dHP:iS+1m9jfrB7ZAskkooooH1d

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1400	3532	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 3532	1156	rundll32.exe	83
PID 1156 wrote to memory of 3532	1156	rundll32.exe	83
PID 1156 wrote to memory of 3532	1156	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\70dc67ebdf53c8a58f19a648460121908b6deba8d6e6afa07736b562c6a160fd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\70dc67ebdf53c8a58f19a648460121908b6deba8d6e6afa07736b562c6a160fd.dll,#1
  2⤵
  PID:3532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 648
    3⤵
    - Program crash
    PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3532 -ip 3532
1⤵
PID:4224

memory/3532-133-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download
memory/3532-134-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download