3be0458c8ecdf5412233baa522c40d37ff606ddf8435f5ce84114ac82c2ddaed

Analysis

max time kernel
127s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2023, 12:49

Target

3be0458c8ecdf5412233baa522c40d37ff606ddf8435f5ce84114ac82c2ddaed.dll
Size

5.5MB
MD5

b0f0f17339e445bb2b6fc8b2f95cfaff
SHA1

e8f6c33e61ef736b3ef0a7c5a1d546c5c5c5b80c
SHA256

3be0458c8ecdf5412233baa522c40d37ff606ddf8435f5ce84114ac82c2ddaed
SHA512

e0684c91d1929888d53596d6c69845540454b6056ecee464de1af94e81b7e5d1e38feef70c63acad89049a80ca1e63d2556dc49e769d18097232217c4329d8a0
SSDEEP

98304:JusYTWLexlJyFJ3gBACUQrd+JeoFr+C3rBTgtbY2KcNw8oVfIAlRk4KLNWeUFV7j:UsYXxlM7e/wlT0yGTlj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4856	4692	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 4692	3032	rundll32.exe	82
PID 3032 wrote to memory of 4692	3032	rundll32.exe	82
PID 3032 wrote to memory of 4692	3032	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3be0458c8ecdf5412233baa522c40d37ff606ddf8435f5ce84114ac82c2ddaed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3be0458c8ecdf5412233baa522c40d37ff606ddf8435f5ce84114ac82c2ddaed.dll,#1
  2⤵
  PID:4692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 652
    3⤵
    - Program crash
    PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4692 -ip 4692
1⤵
PID:5064