4e8d593077b145cab461ec84016d03e5a4802e97196b98ff296c4370693d0cb9

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
17-09-2023 01:34

Target

4e8d593077b145cab461ec84016d03e5a4802e97196b98ff296c4370693d0cb9.dll
Size

218KB
MD5

c5164532fdc2baec9aafd8982ac87bae
SHA1

5c1d13333413bdaba7b192510579a7a684417f5d
SHA256

4e8d593077b145cab461ec84016d03e5a4802e97196b98ff296c4370693d0cb9
SHA512

add3c349748120d98fce6226ea0b01056d54c6af612b10ff830af840f3aac538bd371ad181f1d0de03e327d70d24713f3fcce94c0d303cb99d86226d8618f167
SSDEEP

3072:4fyTFpiSc43UtiD8Umh8I6lk0bF+EjJeNDU2a7i78nifiRjdUKH58YBS:4flD4ktiD8UI8I66C+6AsXnifujF

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4868 2748 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4868	2748	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3868 wrote to memory of 2748	3868	rundll32.exe	rundll32.exe
PID 3868 wrote to memory of 2748	3868	rundll32.exe	rundll32.exe
PID 3868 wrote to memory of 2748	3868	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e8d593077b145cab461ec84016d03e5a4802e97196b98ff296c4370693d0cb9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3868

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e8d593077b145cab461ec84016d03e5a4802e97196b98ff296c4370693d0cb9.dll,#1
2⤵
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 632
3⤵
- Program crash
PID:4868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2748 -ip 2748
1⤵
PID:4644