b9fbab43cf6944ee904ae24d3d0bc877491970bf1f9ee734856a1784314c9b72

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2023, 14:28

Target

b9fbab43cf6944ee904ae24d3d0bc877491970bf1f9ee734856a1784314c9b72.dll
Size

2.0MB
MD5

d47accab1eb22a0fb44ff3668ed547ef
SHA1

21a54949d24a629fb9c5f905a53ceab55f6ea570
SHA256

b9fbab43cf6944ee904ae24d3d0bc877491970bf1f9ee734856a1784314c9b72
SHA512

451e763aacf08ccabaabcf8505112cb9e6070573c668c875dc1dcd32ebde00627af87f8cbd495587637053d79d76604e62047feab470cc836ad86fb87d21a763
SSDEEP

49152:OF5AF8sbtuIHL2foYei/H7CeeRgKBhG6KBnTYnG5wwc+DZyJAEfB6Q7:uS8sbtukyfAi/H7Ce8LJKBnTYnG5wwcQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
940	1480	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 1480	4688	rundll32.exe	81
PID 4688 wrote to memory of 1480	4688	rundll32.exe	81
PID 4688 wrote to memory of 1480	4688	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9fbab43cf6944ee904ae24d3d0bc877491970bf1f9ee734856a1784314c9b72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9fbab43cf6944ee904ae24d3d0bc877491970bf1f9ee734856a1784314c9b72.dll,#1
  2⤵
  PID:1480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 652
    3⤵
    - Program crash
    PID:940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1480 -ip 1480
1⤵
PID:2092