024699cb6719a8266438bf9aa0bdefd96bc5675c5319488ed428001ff7eaa8c3

Analysis

max time kernel
57s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2023, 15:36

Target
024699cb6719a8266438bf9aa0bdefd96bc5675c5319488ed428001ff7eaa8c3.dll
Size 134KB
Sample230221-s2d2nafc86
SHA256 024699cb6719a8266438bf9aa0bdefd96bc5675c5319488ed428001ff7eaa8c3
MD5 85cb8ae7d16f46c45e4dc10f3e2ed2cb
SHA1 be140513c526296b45ee1d7d0fd9d6b6dc233a3a
SHA512 d4ccdc7dd139b9cfab5f99284abc2d8be1f6686203987943a5b11b074c5a5c2f8fa43b20132f4ee5870df20cd00e0e87b502c4d5ee40f5cf34a5ee5e7e3061d5
SSDEEP 3072:KxUBKbkUOwRmBXmn/98wv77pUgAQJG7BfQTBf/LooR:6Dglo98anKVQJ2BfQTBXLooR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3708	4660	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 4660	380	rundll32.exe	79
PID 380 wrote to memory of 4660	380	rundll32.exe	79
PID 380 wrote to memory of 4660	380	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\024699cb6719a8266438bf9aa0bdefd96bc5675c5319488ed428001ff7eaa8c3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\024699cb6719a8266438bf9aa0bdefd96bc5675c5319488ed428001ff7eaa8c3.dll,#1
  2⤵
  PID:4660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 588
    3⤵
    - Program crash
    PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4660 -ip 4660
1⤵
PID:4088