25e2b25a77c09da623a453989fbff3577af67c15ec0a2878acc2de7bf83fab32

Analysis

max time kernel
105s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2023, 19:34

Target

25e2b25a77c09da623a453989fbff3577af67c15ec0a2878acc2de7bf83fab32.dll
Size

264KB
MD5

6d4d0c75249acfbe8dc8b342bc678224
SHA1

504adb4b02a68c850b6ed1d5694def6014ad8d63
SHA256

25e2b25a77c09da623a453989fbff3577af67c15ec0a2878acc2de7bf83fab32
SHA512

bf398a4ae5c4517421706ef2bf74a46872fb009808e801576d048d55cd14a225a4f3f6fe29644f559d1379efe24f92f7f947e9ad11f203e166aa4ba8f1b0927d
SSDEEP

6144:u1cBNnIOW9NSrxsiJle38U53FN3sUZm071:umRIO2NS/ep3FN3sCm071

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3256	2804	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2804	1660	rundll32.exe	88
PID 1660 wrote to memory of 2804	1660	rundll32.exe	88
PID 1660 wrote to memory of 2804	1660	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25e2b25a77c09da623a453989fbff3577af67c15ec0a2878acc2de7bf83fab32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\25e2b25a77c09da623a453989fbff3577af67c15ec0a2878acc2de7bf83fab32.dll,#1
  2⤵
  PID:2804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 648
    3⤵
    - Program crash
    PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2804 -ip 2804
1⤵
PID:2068

memory/2804-133-0x0000000010000000-0x000000001004B000-memory.dmp

Filesize
300KB

Download