f1af634ce93738534bb33d144381dada0c2b14e856a840337386183d3cc35fd0

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2023, 03:48

Target

f1af634ce93738534bb33d144381dada0c2b14e856a840337386183d3cc35fd0.dll
Size

2.1MB
MD5

c7585d333d13acfb7e2503cbb197d933
SHA1

2757f31e61b36eedf7a16fe2495ef5f24660827f
SHA256

f1af634ce93738534bb33d144381dada0c2b14e856a840337386183d3cc35fd0
SHA512

ebc2f55a8215375b209687334f7c626087b5cc357d237cd142d6aa3e1dd1aa3e6fb844cbbdb9cad098c300b163f1fdb2e30f68de9254145051327d29e50ebbf8
SSDEEP

49152:vcz84B3/mJoQAXJmdmEfZOkNPSTqctjRTDpJMMx1q0:k7l/eMcjPSTqsL5xU0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2688	3828	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 3828	3196	rundll32.exe	82
PID 3196 wrote to memory of 3828	3196	rundll32.exe	82
PID 3196 wrote to memory of 3828	3196	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1af634ce93738534bb33d144381dada0c2b14e856a840337386183d3cc35fd0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1af634ce93738534bb33d144381dada0c2b14e856a840337386183d3cc35fd0.dll,#1
  2⤵
  PID:3828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 568
    3⤵
    - Program crash
    PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3828 -ip 3828
1⤵
PID:516