12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1

Analysis

max time kernel
406s
max time network
422s
platform
windows10-2004_x64
resource
win10v2004-20230703-es
resource tags

arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02/08/2023, 23:39

Target

Common Files/Common.dll
Size

224KB
MD5

9fbd11d7b43d9c8a96fbcb15bae1f978
SHA1

f1e6925731a4c437bd07e3f9ad4d63854e602ee5
SHA256

870d629095dffc8085358572393936e722416e22a610f524b1857c3ae9b66593
SHA512

6ec05b74552db8265de6fd56d659606c802b79c08d9cbe3f7e135d47cfbf24ea98e9fdf2d1e2c753ae109f7bc3df61dd2a82e9b6d7dca805bc0df2b8f5dbd79d
SSDEEP

3072:ibGkND9kmQEIgnb6eMg6xYQ88hY0mYBfLuRE6FzUvCEcNgorwEseDFACJ:iSJrElb6w8bBfLubUvCtgQwEseK0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	4756	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4756	4680	rundll32.exe	83
PID 4680 wrote to memory of 4756	4680	rundll32.exe	83
PID 4680 wrote to memory of 4756	4680	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\Common.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\Common.dll",#1
  2⤵
  PID:4756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 672
    3⤵
    - Program crash
    PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4756 -ip 4756
1⤵
PID:884

memory/4756-133-0x0000000000FC0000-0x0000000000FD9000-memory.dmp

Filesize
100KB

Download
memory/4756-134-0x0000000002970000-0x000000000299F000-memory.dmp

Filesize
188KB

Download
memory/4756-136-0x00000000029A0000-0x0000000002FA9000-memory.dmp

Filesize
6.0MB

Download
memory/4756-138-0x0000000002FB0000-0x0000000003589000-memory.dmp

Filesize
5.8MB

Download
memory/4756-140-0x0000000003590000-0x000000000359D000-memory.dmp

Filesize
52KB

Download