ca2e3ff0e46c1127509456ea62f89f7de98881e72659ca88b3fbb4d6046a7752

Analysis

max time kernel
138s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16-08-2023 05:30

Target

ca2e3ff0e46c1127509456ea62f89f7de98881e72659ca88b3fbb4d6046a7752.dll
Size

949KB
MD5

ab85174a58d51fcaa498e88e203b0b3b
SHA1

484e2e1924c7988e44ce1c8ddff2c31b4e81af73
SHA256

ca2e3ff0e46c1127509456ea62f89f7de98881e72659ca88b3fbb4d6046a7752
SHA512

e4200c075386cf3d8d2319cb0849439144ddcf602e7484a01a91e2489e9c23eedab87fb73b212edcf2e4ad092d0051c43c8040565160b001c152786bb9637d1d
SSDEEP

24576:/UrlxUTEEp0nDkklplEzl7jCslbcrbZjQFnrEH7k:MrlxUTKDkkzqZfCslIbZjQFF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5000	1128	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 1128	4168	rundll32.exe	80
PID 4168 wrote to memory of 1128	4168	rundll32.exe	80
PID 4168 wrote to memory of 1128	4168	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca2e3ff0e46c1127509456ea62f89f7de98881e72659ca88b3fbb4d6046a7752.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca2e3ff0e46c1127509456ea62f89f7de98881e72659ca88b3fbb4d6046a7752.dll,#1
  2⤵
  PID:1128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 560
    3⤵
    - Program crash
    PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 1128 -ip 1128
1⤵
PID:3592