4d82f3b3ad27381c2e9386d3e4d93a7e4ef12e518c7699300fa6d368be8c760b

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 20:01

Target

4d82f3b3ad27381c2e9386d3e4d93a7e4ef12e518c7699300fa6d368be8c760b.dll
Size

472KB
MD5

85774e1cf5f26bbead53d08545bb6ff5
SHA1

6ff6aacb1657f15014d70578e15383b445a8a97e
SHA256

4d82f3b3ad27381c2e9386d3e4d93a7e4ef12e518c7699300fa6d368be8c760b
SHA512

814d8fdf3812d9136708e6ee719df4c3219f16c1ecbb9eb39050cf10c13686d3f743b767c50f55357e46d416da32a0b94eb564c89081fee86ae7a42e1005e87d
SSDEEP

12288:BryAE9xNHdwwDi+9NXXzm4L/c16ZY5vGkW4ZLCGVGYSOM:BrcNHdHDi+9NXXzm4L/c16ZY5vGkW4ZY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
212	32	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 32	4108	rundll32.exe	83
PID 4108 wrote to memory of 32	4108	rundll32.exe	83
PID 4108 wrote to memory of 32	4108	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d82f3b3ad27381c2e9386d3e4d93a7e4ef12e518c7699300fa6d368be8c760b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4d82f3b3ad27381c2e9386d3e4d93a7e4ef12e518c7699300fa6d368be8c760b.dll,#1
  2⤵
  PID:32
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 616
    3⤵
    - Program crash
    PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 32 -ip 32
1⤵
PID:3100

memory/32-0-0x0000000075630000-0x00000000756A7000-memory.dmp

Filesize
476KB

Download