99b9d1d44a83d81dac7808ab96969ba5d879ce0b5411ec1315a64423dd766813

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 08:14

Target

99b9d1d44a83d81dac7808ab96969ba5d879ce0b5411ec1315a64423dd766813.dll
Size

13.5MB
MD5

dd49932d0259e5a1454f7371c2219345
SHA1

1cb68ea08ff0409ee6fce6ece2520cfd76f4cb87
SHA256

99b9d1d44a83d81dac7808ab96969ba5d879ce0b5411ec1315a64423dd766813
SHA512

9e599817174fc784d52a11326b61c9957f02c12e3e07fa8b1e5c2641ccbc4aed210dd40fc4555907a9cdc9c9977971b0909f48dfe972c1fbed3496b760beedc7
SSDEEP

196608:7WwgQg3axeEjsCo0sFkVRDGwBdKpdqC7MRPOZnTYiNWvvRRYcOim7U03yX+enwkP:qjwdHjRGW4n57MEYV5RYTz75penwUr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4796	4764	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 4764	2580	rundll32.exe	85
PID 2580 wrote to memory of 4764	2580	rundll32.exe	85
PID 2580 wrote to memory of 4764	2580	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99b9d1d44a83d81dac7808ab96969ba5d879ce0b5411ec1315a64423dd766813.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\99b9d1d44a83d81dac7808ab96969ba5d879ce0b5411ec1315a64423dd766813.dll,#1
  2⤵
  PID:4764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 708
    3⤵
    - Program crash
    PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4764 -ip 4764
1⤵
PID:1780

memory/4764-0-0x0000000010000000-0x00000000113B3000-memory.dmp

Filesize
19.7MB

Download
memory/4764-2-0x0000000005830000-0x0000000005BF2000-memory.dmp

Filesize
3.8MB

Download
memory/4764-4-0x0000000005830000-0x0000000005BF2000-memory.dmp

Filesize
3.8MB

Download
memory/4764-7-0x0000000005830000-0x0000000005BF2000-memory.dmp

Filesize
3.8MB

Download
memory/4764-11-0x0000000005830000-0x0000000005BF2000-memory.dmp

Filesize
3.8MB

Download
memory/4764-15-0x0000000005830000-0x0000000005BF2000-memory.dmp

Filesize
3.8MB

Download
memory/4764-19-0x0000000005830000-0x0000000005BF2000-memory.dmp

Filesize
3.8MB

Download
memory/4764-23-0x0000000005830000-0x0000000005BF2000-memory.dmp

Filesize
3.8MB

Download
memory/4764-26-0x0000000005830000-0x0000000005BF2000-memory.dmp

Filesize
3.8MB

Download
memory/4764-27-0x0000000005830000-0x0000000005BF2000-memory.dmp

Filesize
3.8MB

Download
memory/4764-28-0x0000000005830000-0x0000000005BF2000-memory.dmp

Filesize
3.8MB

Download
memory/4764-29-0x0000000005830000-0x0000000005BF2000-memory.dmp

Filesize
3.8MB

Download