1fa8af0983d38135fc7b5db4f174b799742549c02084f61f2a3ba0e99693647a

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2023, 20:36

Target

1fa8af0983d38135fc7b5db4f174b799742549c02084f61f2a3ba0e99693647a.dll
Size

498KB
MD5

4785e0a678d14da13a96ae25faaaee46
SHA1

8ef04d0e12b5958e6ffc37b0f1368104cd052a03
SHA256

1fa8af0983d38135fc7b5db4f174b799742549c02084f61f2a3ba0e99693647a
SHA512

61fa01cea63b881a757c56f8b95c32ba8d373b017ebd04505db185b0ba549fe69c082405c4f751c8b8ed3ec196e5d280f9a2521021b0b6a5d8374e5eed176b1f
SSDEEP

3072:m/LS/SeGuxcWaUs5FyFc8GYnOLHcm3oSZZAg0Fu5JN3NUC11v:UQSeGKYUs5FypGrl3dZZAO5LNfX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4076	5080	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 5080	2124	rundll32.exe	85
PID 2124 wrote to memory of 5080	2124	rundll32.exe	85
PID 2124 wrote to memory of 5080	2124	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fa8af0983d38135fc7b5db4f174b799742549c02084f61f2a3ba0e99693647a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fa8af0983d38135fc7b5db4f174b799742549c02084f61f2a3ba0e99693647a.dll,#1
  2⤵
  PID:5080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 540
    3⤵
    - Program crash
    PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 5080 -ip 5080
1⤵
PID:800