f37b84d750b684792eb9321c392f99bff79f41583aa44c03af51c617a5d117f9

Analysis

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2023 23:32

Target

f37b84d750b684792eb9321c392f99bff79f41583aa44c03af51c617a5d117f9.dll
Size

116KB
MD5

40c14ac88a6e8f037f64c615ea0db06d
SHA1

2807334e87cd54f6f2d216131a7d4e05ec107ad2
SHA256

f37b84d750b684792eb9321c392f99bff79f41583aa44c03af51c617a5d117f9
SHA512

7b92e8fd75be77c048e9d8db5fad70bf378bcd06d3ba222176a932a086227cb55e4db8d5ac8043208d3dc96efe6376997f1662928260ca7473605e29cfdfde63
SSDEEP

3072:8511XjdOCqDBIFG7uh3oeZ0SULJbr6NbU:8WFBD3SU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	3716	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 3716	3532	rundll32.exe	82
PID 3532 wrote to memory of 3716	3532	rundll32.exe	82
PID 3532 wrote to memory of 3716	3532	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f37b84d750b684792eb9321c392f99bff79f41583aa44c03af51c617a5d117f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f37b84d750b684792eb9321c392f99bff79f41583aa44c03af51c617a5d117f9.dll,#1
  2⤵
  PID:3716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 640
    3⤵
    - Program crash
    PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3716 -ip 3716
1⤵
PID:4716

memory/3716-0-0x0000000075070000-0x000000007508E000-memory.dmp

Filesize
120KB

Download