cd3b542fae4893e9ee92b644448677ecb71c47e9f2300d4b3fd4d86aa3efc6ba

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2023 17:25

Target

00b48568a42b58exe_JC.dll
Size

203KB
MD5

00b48568a42b58057941a4dbdba8bd25
SHA1

c4d1110592800069fecbf610ea38df53b75a7c06
SHA256

cd3b542fae4893e9ee92b644448677ecb71c47e9f2300d4b3fd4d86aa3efc6ba
SHA512

bdf9979297bc24c20b6c32f4200dce628db012fbbd28763196faae4d91862ce6ea85a1f8bb8ca792ca7ead40b04fba44142a708412d8f974d689d2ef4904b246
SSDEEP

3072:PYaW8qUEflaASmkDs1oo8CUS5D+u73vqQ+z+F62hAxquMfgj5jdUy5sZ:PFHEfoAaDQoo8CUwxTvhU+F66fgVj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4764 2140 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4764	2140	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1428 wrote to memory of 2140	1428	rundll32.exe	rundll32.exe
PID 1428 wrote to memory of 2140	1428	rundll32.exe	rundll32.exe
PID 1428 wrote to memory of 2140	1428	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00b48568a42b58exe_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00b48568a42b58exe_JC.dll,#1
2⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 632
3⤵
- Program crash
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2140 -ip 2140
1⤵
PID:4824