ffc7139f6d09af6ad49a3f611f5525700b789a12059e289678314bd0b72b4df3

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 11:24

Target
easy_Benign_ffc7139f6d09af6ad49a3f611f5525700b789a12059e289678314bd0b72b4df3.dll
Size 11KB
Sample230719-nhvsvaeb3t
SHA256 ffc7139f6d09af6ad49a3f611f5525700b789a12059e289678314bd0b72b4df3
MD5 4f41ea6d700795c9f99801cda38d67db
SHA1 f1304c5a06d1c82c6e6e7141677ffc1d926a9718
SHA512 89ec28471ae7aa46fae77959f4e16224bfa393fde36c97e55a39e016fbdc8cb736a58db61816a9ad817dbd8478dc272f161d8cf73a5d4c6eda51da4c706e8def
SSDEEP 192:9Wuhz8aI4HJ0ZxT2toHrwbJAm8Fm/PhkKI:9hwaHO2uXm8FIeKI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	4708	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4708	3980	rundll32.exe	84
PID 3980 wrote to memory of 4708	3980	rundll32.exe	84
PID 3980 wrote to memory of 4708	3980	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\easy_Benign_ffc7139f6d09af6ad49a3f611f5525700b789a12059e289678314bd0b72b4df3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\easy_Benign_ffc7139f6d09af6ad49a3f611f5525700b789a12059e289678314bd0b72b4df3.dll,#1
  2⤵
  PID:4708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 600
    3⤵
    - Program crash
    PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4708 -ip 4708
1⤵
PID:436

memory/4708-133-0x000000006CA40000-0x000000006CA4B000-memory.dmp

Download