221f12fdd13b138add0e220b75ecfe16613ebaa7cc921ce5bab12c4833be8861

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2023, 23:05

Target

221f12fdd13b138add0e220b75ecfe16613ebaa7cc921ce5bab12c4833be8861.dll
Size

2.6MB
MD5

1b8b7311dc09cd082228cc89724adf32
SHA1

1ee8b1f310476267787e4e2aac364daf73702a72
SHA256

221f12fdd13b138add0e220b75ecfe16613ebaa7cc921ce5bab12c4833be8861
SHA512

07e6fd7a2ab9702d68e7404e19b59a994f8da3185dc5083d32ce027dd5456713c966327c624cc5c4ae7c368f7b592ec2859e54cc5d256733b1feea041237d7a0
SSDEEP

49152:RkyaNDATHFTlb8zC+XO0P8QZj9Pu22I5Ki+lcFUEwZV/VcvO4ZiBFZR+nuB:RkFAFR8zZXFP82mZIr4cUE6VNOO4ZiB/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2784	2916	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2916	rundll32.exe
2916	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2916	2680	rundll32.exe	84
PID 2680 wrote to memory of 2916	2680	rundll32.exe	84
PID 2680 wrote to memory of 2916	2680	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\221f12fdd13b138add0e220b75ecfe16613ebaa7cc921ce5bab12c4833be8861.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\221f12fdd13b138add0e220b75ecfe16613ebaa7cc921ce5bab12c4833be8861.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 832
    3⤵
    - Program crash
    PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2916 -ip 2916
1⤵
PID:1412

memory/2916-133-0x00000000749E0000-0x0000000074EDE000-memory.dmp

Filesize
5.0MB

Download
memory/2916-137-0x00000000749E0000-0x0000000074EDE000-memory.dmp

Filesize
5.0MB

Download
memory/2916-138-0x00000000749E0000-0x0000000074EDE000-memory.dmp

Filesize
5.0MB

Download
memory/2916-139-0x0000000002BF0000-0x0000000002C84000-memory.dmp

Filesize
592KB

Download
memory/2916-140-0x0000000003EF0000-0x0000000003F64000-memory.dmp

Filesize
464KB

Download
memory/2916-142-0x0000000004080000-0x0000000004139000-memory.dmp

Filesize
740KB

Download
memory/2916-143-0x0000000004160000-0x00000000041FB000-memory.dmp

Filesize
620KB

Download
memory/2916-141-0x0000000004070000-0x000000000407F000-memory.dmp

Filesize
60KB

Download
memory/2916-144-0x0000000004200000-0x000000000447E000-memory.dmp

Filesize
2.5MB

Download
memory/2916-145-0x00000000749E0000-0x0000000074EDE000-memory.dmp

Filesize
5.0MB

Download