dbd5b4fec86c1b3126e819632fa5276a112fdb90e276eaefc02831609ab0a033

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2023, 19:07

Target

dbd5b4fec86c1b3126e819632fa5276a112fdb90e276eaefc02831609ab0a033.dll
Size

1.1MB
MD5

8b9003d8da193b6a57505e4b125b24c3
SHA1

98a7b8bcb124315ce5e7e4d47108841da8cacf64
SHA256

dbd5b4fec86c1b3126e819632fa5276a112fdb90e276eaefc02831609ab0a033
SHA512

0252984d94e1213a531f4cc7d50ae65a8cac030455d4a3b737d13b764880fc0701400b3990d07e5120401086de0c4398fd8f1a6add30f598da369dad2248fa32
SSDEEP

24576:ayMr/3zZjI3nrglW12G7QTE/n+A94dXp1nKERBsshhCabRmoe5zFVhKr2:50OsToWAkaFoghKS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	1696	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 1696	4052	rundll32.exe	83
PID 4052 wrote to memory of 1696	4052	rundll32.exe	83
PID 4052 wrote to memory of 1696	4052	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbd5b4fec86c1b3126e819632fa5276a112fdb90e276eaefc02831609ab0a033.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbd5b4fec86c1b3126e819632fa5276a112fdb90e276eaefc02831609ab0a033.dll,#1
  2⤵
  PID:1696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 584
    3⤵
    - Program crash
    PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1696 -ip 1696
1⤵
PID:3532

memory/1696-133-0x0000000075560000-0x0000000075679000-memory.dmp

Filesize
1.1MB

Download
memory/1696-134-0x00000000762C0000-0x00000000764D5000-memory.dmp

Filesize
2.1MB

Download
memory/1696-2072-0x0000000075560000-0x00000000755D4000-memory.dmp

Filesize
464KB

Download