d19740e18d4031711187e541002fbe931385a48d32c299664acbf836d45a269f

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2023 00:41

Target

d19740e18d4031711187e541002fbe931385a48d32c299664acbf836d45a269f.dll
Size

229KB
MD5

4d001eb37c664067b0f414b424d31181
SHA1

a5e59773bbd658eb41b46239a0c4d83fc115b93c
SHA256

d19740e18d4031711187e541002fbe931385a48d32c299664acbf836d45a269f
SHA512

25ed7960d001cc2aac0094029a2854031c8433d621a8a9497abace9e28c7b529642d7f9dde1a0183895cbe3ddbd035f401823aa2db797aff635611d87d1735c3
SSDEEP

3072:Cewku2OJl9X8QwD256zHz0HeKXMmAg0FubpTBfu8xess92GTOlgNHrb0GUBmPHBW:xwf2O8D25wTCzAO1TBG8xeNNVheqtk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4840	4892	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 4892	3608	rundll32.exe	85
PID 3608 wrote to memory of 4892	3608	rundll32.exe	85
PID 3608 wrote to memory of 4892	3608	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d19740e18d4031711187e541002fbe931385a48d32c299664acbf836d45a269f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d19740e18d4031711187e541002fbe931385a48d32c299664acbf836d45a269f.dll,#1
  2⤵
  PID:4892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 604
    3⤵
    - Program crash
    PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4892 -ip 4892
1⤵
PID:1532