bdb0653f3d62ad5b95e94c013d44b64bd7d330f516976187d91e6801a2fc1fcf

Analysis

max time kernel
84s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2023, 00:59

Target

bdb0653f3d62ad5b95e94c013d44b64bd7d330f516976187d91e6801a2fc1fcf.dll
Size

215KB
MD5

0aa0da9e53b05099bc024a7b81be761f
SHA1

37f0cac29c625638824453d1986093e690b766b8
SHA256

bdb0653f3d62ad5b95e94c013d44b64bd7d330f516976187d91e6801a2fc1fcf
SHA512

88792aa1a34ced677bb8020bd6f85ba2208f1fbe9700479d53e36b0b6f190c0a8461f793626a16dec035762470e4ed42b038f534d64254fc4662290a962c6715
SSDEEP

6144:i/9lZWbcwKD6NjB1AO1TB68xeWNVjSS7n:a9lZgc+NB1XT48xeWNhSS7n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4152	2148	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 2148	4000	rundll32.exe	87
PID 4000 wrote to memory of 2148	4000	rundll32.exe	87
PID 4000 wrote to memory of 2148	4000	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdb0653f3d62ad5b95e94c013d44b64bd7d330f516976187d91e6801a2fc1fcf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdb0653f3d62ad5b95e94c013d44b64bd7d330f516976187d91e6801a2fc1fcf.dll,#1
  2⤵
  PID:2148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 600
    3⤵
    - Program crash
    PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2148 -ip 2148
1⤵
PID:2032