445b9c2bc1737018cc1482abbc5eab105d1329c78e9f4ab66bbd63142322276b

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2023 19:07

Target

445b9c2bc1737018cc1482abbc5eab105d1329c78e9f4ab66bbd63142322276b.dll
Size

944KB
MD5

c9b2740e31322588e5f66a97a35322f4
SHA1

869a2cc3714cac7e1b358cb64b5944572bf2a6b4
SHA256

445b9c2bc1737018cc1482abbc5eab105d1329c78e9f4ab66bbd63142322276b
SHA512

ab07ebbbe238a6a29ef33070708f14f763b3b4199843477e9fba794da4d61ba0e6c7a35024a409c8ce67b15abebb8ff18f79ee496bffed4fdb840e7aee6be8e9
SSDEEP

24576:wP9TyHzDlTUmwCd36PU2r9HBqaSXVGHY5bm7:w1eTZ4mVoZHAaAsHY5i7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4580 1176 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4580	1176	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2736 wrote to memory of 1176	2736	rundll32.exe	rundll32.exe
PID 2736 wrote to memory of 1176	2736	rundll32.exe	rundll32.exe
PID 2736 wrote to memory of 1176	2736	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\445b9c2bc1737018cc1482abbc5eab105d1329c78e9f4ab66bbd63142322276b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2736

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\445b9c2bc1737018cc1482abbc5eab105d1329c78e9f4ab66bbd63142322276b.dll,#1
2⤵
PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 740
3⤵
- Program crash
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1176 -ip 1176
1⤵
PID:3352

memory/1176-134-0x0000000002330000-0x00000000025C6000-memory.dmp

Filesize
2.6MB

Download
memory/1176-133-0x0000000002330000-0x00000000025C6000-memory.dmp

Filesize
2.6MB

Download
memory/1176-135-0x0000000002330000-0x00000000025C6000-memory.dmp

Filesize
2.6MB

Download
memory/1176-136-0x0000000002330000-0x00000000025C6000-memory.dmp

Filesize
2.6MB

Download
memory/1176-137-0x0000000002330000-0x00000000025C6000-memory.dmp

Filesize
2.6MB

Download