e9163dbc6fdcec29b09a26dbb3c88e51236245d1841cd197c59cdd582c7df7ea

Analysis

max time kernel
137s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2023, 16:09

Target

a0UFMZnC6ltxphw.dat.dll
Size

281KB
MD5

294d2e3b30432e0fbbe53aebef27c571
SHA1

21b68fe0cb0e0a028271c99d727dfb57b3201485
SHA256

e9163dbc6fdcec29b09a26dbb3c88e51236245d1841cd197c59cdd582c7df7ea
SHA512

da77c178408f7cc6396cac77ef2cbb753f4bb3a002b26ac93f49bc29bba676811784b14b5611c794e12add3307fec85648b883ad8a0a91664b5c1e9f3925a298
SSDEEP

6144:wnCa7uW+h+IJE+edVtbIDBJF0Ecns6y9cjo2iwJtsykZHqxO34aG30VmXSmzlkRI:W77uEs6T39JDVGF4sjWpx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4508	3776	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 3776	3948	rundll32.exe	83
PID 3948 wrote to memory of 3776	3948	rundll32.exe	83
PID 3948 wrote to memory of 3776	3948	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0UFMZnC6ltxphw.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0UFMZnC6ltxphw.dat.dll,#1
  2⤵
  PID:3776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 600
    3⤵
    - Program crash
    PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3776 -ip 3776
1⤵
PID:5084