2b7929ec39b0eec8c5e654669683b1ea584711f82ca8678ccbd3dc26e4673f79

Analysis

max time kernel
87s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2023 11:35

Target

2b7929ec39b0eec8c5e654669683b1ea584711f82ca8678ccbd3dc26e4673f79.dll
Size

120KB
MD5

1a106da5763d703c717fd84ab0fac788
SHA1

0041c9fa5c3c7b42907386d5571b7d785e1aff0c
SHA256

2b7929ec39b0eec8c5e654669683b1ea584711f82ca8678ccbd3dc26e4673f79
SHA512

7e1c8e7a91dc14b753b1c5ff5a7f59c638aebfd266326ba5593c3d46138ab5977c2a28ce1825fe384b78a239448e9f8921af72038be7d297daf646729f8fb90c
SSDEEP

3072:y2phOM5tqqUgQ18k7/zooJLJ0FL1fInCelFXirY6bs:y+OM5tjO1F7u1Qn/vyUF

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4736 4624 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4736	4624	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1120 wrote to memory of 4624	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 4624	1120	rundll32.exe	rundll32.exe
PID 1120 wrote to memory of 4624	1120	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b7929ec39b0eec8c5e654669683b1ea584711f82ca8678ccbd3dc26e4673f79.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b7929ec39b0eec8c5e654669683b1ea584711f82ca8678ccbd3dc26e4673f79.dll,#1
2⤵
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 632
3⤵
- Program crash
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4624 -ip 4624
1⤵
PID:2072

memory/4624-133-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/4624-134-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/4624-135-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/4624-136-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/4624-137-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/4624-138-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download