4a1b6cfd5bd497571f88e2cbf302d5d5ccc29f5939950bac947765afe0a70181

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 04:12

Target

4a1b6cfd5bd497571f88e2cbf302d5d5ccc29f5939950bac947765afe0a70181.dll
Size

1.4MB
MD5

7f28f980480d1a1e17850e38ba8748fb
SHA1

175389eed193cae3eb22a0ed7bfb570ef80d1f1f
SHA256

4a1b6cfd5bd497571f88e2cbf302d5d5ccc29f5939950bac947765afe0a70181
SHA512

e1ef647b26d2f422dbbc687245911ffc88056483416b0e630bab04248473eb402ef83b1c7cfc6c3cd6a280914148a66a89979470148d6205af76c3d0c5356af0
SSDEEP

24576:r9NGBZXQQQQQQQzriv9ETf7DAaJegK+3G8:r9NmXQQQQQQQzriv9CXY8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4972	3404	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 3404	1820	rundll32.exe	81
PID 1820 wrote to memory of 3404	1820	rundll32.exe	81
PID 1820 wrote to memory of 3404	1820	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a1b6cfd5bd497571f88e2cbf302d5d5ccc29f5939950bac947765afe0a70181.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a1b6cfd5bd497571f88e2cbf302d5d5ccc29f5939950bac947765afe0a70181.dll,#1
  2⤵
  PID:3404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 624
    3⤵
    - Program crash
    PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3404 -ip 3404
1⤵
PID:4788

memory/3404-133-0x00000000748A0000-0x0000000074A0B000-memory.dmp

Filesize
1.4MB

Download