cf6d0bd698a982b2ced387d58cea7591fe10df67e1f50247e301443b3e08e33e

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 09:27

Target

cf6d0bd698a982b2ced387d58cea7591fe10df67e1f50247e301443b3e08e33e.dll
Size

17KB
MD5

17b83e538a4eb825829e23afb220050d
SHA1

55ffc338a47c5b34d9ffa21eb881e94b01ace005
SHA256

cf6d0bd698a982b2ced387d58cea7591fe10df67e1f50247e301443b3e08e33e
SHA512

b7ec8962901ff3fb1baf21b466d68d135d4dadad39713aada6d48411696e74f68f258b12eab6aac7126abb29cff271ba4f51d799044139ef4ff3c4dd1ebdc754
SSDEEP

384:nA95H6UQ0/i4FrSniK/N+b/0E69mQ7u7b6D0:CKNi6N+b/0gQ7kmD0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4184	5012	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 5012	2924	rundll32.exe	82
PID 2924 wrote to memory of 5012	2924	rundll32.exe	82
PID 2924 wrote to memory of 5012	2924	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf6d0bd698a982b2ced387d58cea7591fe10df67e1f50247e301443b3e08e33e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf6d0bd698a982b2ced387d58cea7591fe10df67e1f50247e301443b3e08e33e.dll,#1
  2⤵
  PID:5012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 632
    3⤵
    - Program crash
    PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5012 -ip 5012
1⤵
PID:1440