b9416c77d62960bb81a95868fe98eb97f6170a2322556f774d9bc47e800e0d81

Analysis

max time kernel
137s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2023, 19:15

Target

b9416c77d62960bb81a95868fe98eb97f6170a2322556f774d9bc47e800e0d81.dll
Size

340KB
MD5

893269bfe956ba5672efc9435afd0cfd
SHA1

f14007fe7646ee0e6496b3bef95236aac61d5d9d
SHA256

b9416c77d62960bb81a95868fe98eb97f6170a2322556f774d9bc47e800e0d81
SHA512

eb082525296e39a78de521011c3f4bb35ec17e8216d532ea98a0b751ab80908c5e3c89d5bbd1d1789c3395d6ed7b2ae6374bf8401197f79149df7e582b401b55
SSDEEP

6144:xzuTenW0rY6KfT53mdmVYsh08A8T3kOcc8GxHM:0tD0EYsh08A8TV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
832	3252	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 3252	1468	rundll32.exe	81
PID 1468 wrote to memory of 3252	1468	rundll32.exe	81
PID 1468 wrote to memory of 3252	1468	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9416c77d62960bb81a95868fe98eb97f6170a2322556f774d9bc47e800e0d81.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9416c77d62960bb81a95868fe98eb97f6170a2322556f774d9bc47e800e0d81.dll,#1
  2⤵
  PID:3252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 620
    3⤵
    - Program crash
    PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3252 -ip 3252
1⤵
PID:1052

memory/3252-133-0x0000000073130000-0x000000007318E000-memory.dmp

Filesize
376KB

Download