57286f5c0d14bed45375a31656f09adbcbfcac684c93a29f5ca7c2aa446dab78

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2023 03:37

Target

57286f5c0d14bed45375a31656f09adbcbfcac684c93a29f5ca7c2aa446dab78.dll
Size

200KB
MD5

ea5d7f24fe2c13c908453f6da19487db
SHA1

19254459bc871684f86e9c8b234f53e8bdb00374
SHA256

57286f5c0d14bed45375a31656f09adbcbfcac684c93a29f5ca7c2aa446dab78
SHA512

39b8608cce99b57eb08a3a6563dbe7c793fb94d5364ff6fbfbc67a33ad4f18b58c41111dc0518c849466b3105a57b235675683f974aea7b7c37c6280f06da5a7
SSDEEP

3072:7iOWFcvJvAdbbEdoB7BodjHHugqg0q88OP5qCziwr73gqvtXlNTsO:WTF8JvAdb2oBUzHugqgXg5qCbl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4748	400	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 400	2172	rundll32.exe	84
PID 2172 wrote to memory of 400	2172	rundll32.exe	84
PID 2172 wrote to memory of 400	2172	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57286f5c0d14bed45375a31656f09adbcbfcac684c93a29f5ca7c2aa446dab78.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\57286f5c0d14bed45375a31656f09adbcbfcac684c93a29f5ca7c2aa446dab78.dll,#1
  2⤵
  PID:400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 848
    3⤵
    - Program crash
    PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 400 -ip 400
1⤵
PID:2252