f83eed19b381a656d5765e4da64337d234293663764ba442632170d178c5be45

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
30-08-2023 23:16

Target

f83eed19b381a656d5765e4da64337d234293663764ba442632170d178c5be45.dll
Size

140KB
MD5

c14c19bffb613db3a83ead5ca9d2db9f
SHA1

72f2c94780f6f26a0ff8c13efde47d14d60661e6
SHA256

f83eed19b381a656d5765e4da64337d234293663764ba442632170d178c5be45
SHA512

100e5592c0ac96e0d42a23168ad8ac354c2d1618136484254adb3a94e95fec589a3651525eaa081444113070b721aacf20e4267f39acad443913ac4f226a3a53
SSDEEP

3072:xd3b3cGM1R8GhWyDSWfsUQzxwGevZqgAbBdlaJb:xxH2WEftQdSZqgAzlOb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
540	1536	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1536	2200	rundll32.exe	81
PID 2200 wrote to memory of 1536	2200	rundll32.exe	81
PID 2200 wrote to memory of 1536	2200	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f83eed19b381a656d5765e4da64337d234293663764ba442632170d178c5be45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f83eed19b381a656d5765e4da64337d234293663764ba442632170d178c5be45.dll,#1
  2⤵
  PID:1536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 640
    3⤵
    - Program crash
    PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1536 -ip 1536
1⤵
PID:1104

memory/1536-0-0x000000007ABD0000-0x000000007ABFC000-memory.dmp

Filesize
176KB

Download