dfe88cfaf64dd5a239f28f18171e4e5ad5f2d5429f3b2f3af7471296ab178fcd

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2023, 12:23

Target

dfe88cfaf64dd5a239f28f18171e4e5ad5f2d5429f3b2f3af7471296ab178fcd.dll
Size

208KB
MD5

4e49f49ce8f4e45fe371a95945ae1464
SHA1

0b96e861a3a5f56b3c224fb80042ebe1a8caa1b8
SHA256

dfe88cfaf64dd5a239f28f18171e4e5ad5f2d5429f3b2f3af7471296ab178fcd
SHA512

07c9c6e3c0d834323b80943e7b6c8db61a6099e04de7a16646af242154426df365a3a47949e22bc6950fc17b994ba57dd43738812013010074dd5a7770a76eda
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUFvY5r:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3840	2860	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 2860	4604	rundll32.exe	81
PID 4604 wrote to memory of 2860	4604	rundll32.exe	81
PID 4604 wrote to memory of 2860	4604	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfe88cfaf64dd5a239f28f18171e4e5ad5f2d5429f3b2f3af7471296ab178fcd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfe88cfaf64dd5a239f28f18171e4e5ad5f2d5429f3b2f3af7471296ab178fcd.dll,#1
  2⤵
  PID:2860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 632
    3⤵
    - Program crash
    PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2860 -ip 2860
1⤵
PID:4840