5f919b98fe0692407761b9fbc869cfd47cecf3d7386ae340a16f04af4673c2ba

Analysis

max time kernel
180s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2023, 18:53

Target

040aecd723be3d1660473cf075c641d80f3ea19e.dll
Size

1.7MB
MD5

37c3245c8ae6b76f1394210ed66af190
SHA1

040aecd723be3d1660473cf075c641d80f3ea19e
SHA256

5f919b98fe0692407761b9fbc869cfd47cecf3d7386ae340a16f04af4673c2ba
SHA512

1aaeb3c08c4a71d93c8f5f007c543c0164e1071113cb29033d4fe2c8fd2a36c6115bd121d877d6da471014656866208599734bef99f6a5d4f496658d301b4acc
SSDEEP

24576:zrj3nPW3ednWPiT8VTBqcATV8KIyydLXGcq8z+0uaEYmgEJ/tc1:T3nCeCiT8aHxyM18z+XatEJ1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1088	2260	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2260	1672	rundll32.exe	80
PID 1672 wrote to memory of 2260	1672	rundll32.exe	80
PID 1672 wrote to memory of 2260	1672	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\040aecd723be3d1660473cf075c641d80f3ea19e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\040aecd723be3d1660473cf075c641d80f3ea19e.dll,#1
  2⤵
  PID:2260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 600
    3⤵
    - Program crash
    PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2260 -ip 2260
1⤵
PID:4700