319694c6d3edda2705d52641d2b1d15933a2d06dadd1c87c8f14f223f193a1dd

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2023, 23:08

Target

319694c6d3edda2705d52641d2b1d15933a2d06dadd1c87c8f14f223f193a1dd.dll
Size

208KB
MD5

efd7465d29fe7520dd92f516111d1c54
SHA1

62187d2c815e6066ebdc608dc18d969d08a9e750
SHA256

319694c6d3edda2705d52641d2b1d15933a2d06dadd1c87c8f14f223f193a1dd
SHA512

5ae1c34c9132b9489f15d88b45c522415387e5628d6a1f25e06f563decdd93d6328b299d7ce4e4910c6eee7cf661ee38dd5bc1cfc32a6e855179522174b80146
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUIY5j:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4620	536	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 536	4084	rundll32.exe	80
PID 4084 wrote to memory of 536	4084	rundll32.exe	80
PID 4084 wrote to memory of 536	4084	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\319694c6d3edda2705d52641d2b1d15933a2d06dadd1c87c8f14f223f193a1dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\319694c6d3edda2705d52641d2b1d15933a2d06dadd1c87c8f14f223f193a1dd.dll,#1
  2⤵
  PID:536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 632
    3⤵
    - Program crash
    PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 536 -ip 536
1⤵
PID:1308