ac6028f6261e74fe6e7d8a9db05aa7bcf89a693d364b76997470f463e5dc6ef3

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2023, 04:33

Target

ac6028f6261e74fe6e7d8a9db05aa7bcf89a693d364b76997470f463e5dc6ef3.dll
Size

2.1MB
MD5

562f8c36d873970b15177ff4ee489988
SHA1

45d4d32e81bded927a1e58ad29574a7db93f4338
SHA256

ac6028f6261e74fe6e7d8a9db05aa7bcf89a693d364b76997470f463e5dc6ef3
SHA512

d9bdc729e2a7c07c30a4c3976eaf5f684220b3d81e596a092b76455fbc3af3a9c66ffb2d275901c1f460ad7cbd5e5ed315a543666b0735ee17aba9cb39aea9d0
SSDEEP

49152:y8feI79oK2xUrDv31PobhJ/P0BDpinATs75a78tM:y8D7WK2UrtvBDpgh08tM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4768	2584	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 2584	4720	rundll32.exe	82
PID 4720 wrote to memory of 2584	4720	rundll32.exe	82
PID 4720 wrote to memory of 2584	4720	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac6028f6261e74fe6e7d8a9db05aa7bcf89a693d364b76997470f463e5dc6ef3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac6028f6261e74fe6e7d8a9db05aa7bcf89a693d364b76997470f463e5dc6ef3.dll,#1
  2⤵
  PID:2584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 560
    3⤵
    - Program crash
    PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2584 -ip 2584
1⤵
PID:1888