cbd0b8619eb869150c192d4489b6784b9575a6121bdc7fe89ecee0fa2ee78a96

Analysis

max time kernel
118s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2023 20:06

Target

cbd0b8619eb869150c192d4489b6784b9575a6121bdc7fe89ecee0fa2ee78a96.dll
Size

426KB
MD5

89322960bffc0388ae5bbee3918a9c24
SHA1

ec8aa95c311710fe2c39356153290821f65122e5
SHA256

cbd0b8619eb869150c192d4489b6784b9575a6121bdc7fe89ecee0fa2ee78a96
SHA512

b5f53f5f5746920845e4be0e51c51fa1d970448f0b66cf8fa220700960087ed5893ca5203f97cb58d65f27683d7e2ede7f5d64d3c256d3c552ea8c5fcb2c9147
SSDEEP

6144:aBtOOxUQ1tKMl8BMFJHNFkWWfjntVMaWdNG9iXRq0AqhlKybVeVg1WbHRtbNBikQ:aB+QJHIWWffWTGE8jyUZDNEirK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3244	1808	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1808	1276	rundll32.exe	85
PID 1276 wrote to memory of 1808	1276	rundll32.exe	85
PID 1276 wrote to memory of 1808	1276	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbd0b8619eb869150c192d4489b6784b9575a6121bdc7fe89ecee0fa2ee78a96.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbd0b8619eb869150c192d4489b6784b9575a6121bdc7fe89ecee0fa2ee78a96.dll,#1
  2⤵
  PID:1808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 656
    3⤵
    - Program crash
    PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1808 -ip 1808
1⤵
PID:1260

memory/1808-133-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/1808-134-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download
memory/1808-135-0x0000000000400000-0x0000000000520000-memory.dmp

Filesize
1.1MB

Download