affe0024a5e56ed2ce16c33392b024a64f3bdbe2b7edf23a0a5978df56fde93b

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2023, 19:33

Target

affe0024a5e56ed2ce16c33392b024a64f3bdbe2b7edf23a0a5978df56fde93b.dll
Size

152KB
MD5

ba1bfa37a26e7c85eb2a5679537ba9b5
SHA1

0a26943e0ede6a9f688eb3539f366a2dc4ae542a
SHA256

affe0024a5e56ed2ce16c33392b024a64f3bdbe2b7edf23a0a5978df56fde93b
SHA512

b5ff4b0e1087a800f2f9944f3f4bdf4782dbc90bf15ce91148f2d185aea45d09046692587ea2073302c96ff1649220d882726dfa7e9f46dd839e2c3c2673afe6
SSDEEP

3072:+mvq79A6TlY4SZvNW2BI6oWtstKmckPxiTcWckPxiTS2Va:+22Ae+u2Brpt/5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
700	3396	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3396	rundll32.exe
3396	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 3396	4384	rundll32.exe	83
PID 4384 wrote to memory of 3396	4384	rundll32.exe	83
PID 4384 wrote to memory of 3396	4384	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\affe0024a5e56ed2ce16c33392b024a64f3bdbe2b7edf23a0a5978df56fde93b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\affe0024a5e56ed2ce16c33392b024a64f3bdbe2b7edf23a0a5978df56fde93b.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 616
    3⤵
    - Program crash
    PID:700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3396 -ip 3396
1⤵
PID:3456