ab2024dcc15172d845346a61617d3b6ce556d88846e3c62ed4606235ce85f20b

Analysis

max time kernel
2s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2023, 20:20

Target

challange_Benign_ab2024dcc15172d845346a61617d3b6ce556d88846e3c62ed4606235ce85f20b.dll
Size

54KB
MD5

884b932d41cf23c914339fc841d634b4
SHA1

7f0c6934ff0e10581c58dcd7d8ba5466f4bbca1f
SHA256

ab2024dcc15172d845346a61617d3b6ce556d88846e3c62ed4606235ce85f20b
SHA512

74e4708d4b9c4d920d5cd51510b2a89d5d75038261fa090bc3df40ff033947bfa008e5ba88353a15cd806b4122dd5ca6fc440c3a497d03b962d3369bf8d0d636
SSDEEP

768:hc+WPdsPKtU5uzc0WgdNpdSNqhHpNSpKV6B6sGOkidD1Er0S624d1SPdZZ2:h+PAcuur1zeGSPB6sGOkid+B62TVZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3144	1816	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 1816	4104	rundll32.exe	80
PID 4104 wrote to memory of 1816	4104	rundll32.exe	80
PID 4104 wrote to memory of 1816	4104	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\challange_Benign_ab2024dcc15172d845346a61617d3b6ce556d88846e3c62ed4606235ce85f20b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\challange_Benign_ab2024dcc15172d845346a61617d3b6ce556d88846e3c62ed4606235ce85f20b.dll,#1
  2⤵
  PID:1816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 600
    3⤵
    - Program crash
    PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1816 -ip 1816
1⤵
PID:4392

memory/1816-133-0x00000000749F0000-0x0000000074A0A000-memory.dmp

Filesize
104KB

Download
memory/1816-134-0x00000000029C0000-0x00000000029C3000-memory.dmp

Filesize
12KB

Download