b27ac7ca0dd519757dd062bac896870069a8af38e8cc550d5ad8f15574506286

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2023, 19:25

Target

b27ac7ca0dd519757dd062bac896870069a8af38e8cc550d5ad8f15574506286.dll
Size

261KB
MD5

b134bd4af4c721cbfe2a5f67cdf5a6f3
SHA1

1ceafa87475b99fd977bada2feed0a56fb28f7ba
SHA256

b27ac7ca0dd519757dd062bac896870069a8af38e8cc550d5ad8f15574506286
SHA512

a04b3a0e2f39b9f329cd46c9f31724b9547f4462b5861fc9398c42bad3ff6ff8994a5219a0dd8ea1f17015cc5165aba9b00c15448e458272be4bd8431364701f
SSDEEP

3072:zsJufjxKGFTIMVRZf0fh5D9ws0kOYHRtMZ+niwcOR5iOVGBTUX:4ufjxKGqMVrc3F0kGBTa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
920	5032	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 5032	3656	rundll32.exe	81
PID 3656 wrote to memory of 5032	3656	rundll32.exe	81
PID 3656 wrote to memory of 5032	3656	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b27ac7ca0dd519757dd062bac896870069a8af38e8cc550d5ad8f15574506286.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b27ac7ca0dd519757dd062bac896870069a8af38e8cc550d5ad8f15574506286.dll,#1
  2⤵
  PID:5032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 620
    3⤵
    - Program crash
    PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5032 -ip 5032
1⤵
PID:4104

memory/5032-136-0x0000000068100000-0x000000006814B000-memory.dmp

Filesize
300KB

Download