ecbb19eac55cf86ae1b527c1bf51bfec022b0b124304cf667ef79e908ce60637

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2023, 18:57

Target

ecbb19eac55cf86ae1b527c1bf51bfec022b0b124304cf667ef79e908ce60637.dll
Size

128KB
MD5

c4dfbc56dc2394debd09b2cd42cfb26b
SHA1

da4b025c5800e1346a894f9a96fc81191f14922f
SHA256

ecbb19eac55cf86ae1b527c1bf51bfec022b0b124304cf667ef79e908ce60637
SHA512

a2d1781d7990730c6c20825592b45c9494ad81550703512ed74b4362c69313be05e260d8ab6046efb8d3e909f30d2526e032038fbde12a8737ad38eaec029b03
SSDEEP

3072:lj2NVrZU1/SqWP7fRyMvwNtfAlvfVF2G3oD:lCN1ZU9SL7IMUtOVkZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4112	1592	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1592	800	rundll32.exe	84
PID 800 wrote to memory of 1592	800	rundll32.exe	84
PID 800 wrote to memory of 1592	800	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecbb19eac55cf86ae1b527c1bf51bfec022b0b124304cf667ef79e908ce60637.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecbb19eac55cf86ae1b527c1bf51bfec022b0b124304cf667ef79e908ce60637.dll,#1
  2⤵
  PID:1592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 600
    3⤵
    - Program crash
    PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1592 -ip 1592
1⤵
PID:2776

memory/1592-133-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download