5fa59081c28b1a74728f1d983fcd6dcfe92020acd8c3ce9109d97f594b06524f

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2023 05:21

Target

5fa59081c28b1a74728f1d983fcd6dcfe92020acd8c3ce9109d97f594b06524f.dll
Size

232KB
MD5

fc7b5a14d80700587745afeed385c31e
SHA1

2db40bda7bbf9ba3155769214638e59f525632ca
SHA256

5fa59081c28b1a74728f1d983fcd6dcfe92020acd8c3ce9109d97f594b06524f
SHA512

6b203c74fa5506dbd96754f1df8455eb35141c478becabaec5a10ce483809e652e7509d0791aedba53b4070973035d6cb620dc07d84bf3b43c1a7f2d67ea2c7d
SSDEEP

6144:bS8yCpFdygeZVswjM4nQM9HrW8BA9zS8bk4Q:28yS4VsH4n9HrWiH8o

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1400 3176 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1400	3176	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4968 wrote to memory of 3176	4968	rundll32.exe	rundll32.exe
PID 4968 wrote to memory of 3176	4968	rundll32.exe	rundll32.exe
PID 4968 wrote to memory of 3176	4968	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fa59081c28b1a74728f1d983fcd6dcfe92020acd8c3ce9109d97f594b06524f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fa59081c28b1a74728f1d983fcd6dcfe92020acd8c3ce9109d97f594b06524f.dll,#1
2⤵
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 648
3⤵
- Program crash
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3176 -ip 3176
1⤵
PID:964

memory/3176-133-0x0000000000A50000-0x0000000000ADA000-memory.dmp

Filesize
552KB

Download
memory/3176-134-0x0000000000A50000-0x0000000000ADA000-memory.dmp

Filesize
552KB

Download
memory/3176-135-0x0000000000A50000-0x0000000000ADA000-memory.dmp

Filesize
552KB

Download