5489b800678c1a53773aac465b47514f1fc3f4dd71937a4e2983841585c53bdc

Analysis

max time kernel
91s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
17-09-2023 14:16

Target

5489b800678c1a53773aac465b47514f1fc3f4dd71937a4e2983841585c53bdc.dll
Size

218KB
MD5

74310419023423e04ee5212d5cb5c9c3
SHA1

e35cf69cb8c9540621d91ea6274a037a160983cb
SHA256

5489b800678c1a53773aac465b47514f1fc3f4dd71937a4e2983841585c53bdc
SHA512

0e3c38bf545170ebfcc3c5d31cee314e2d757d97a5ab43b5d4b8c782d59fedb11379f9243f1aba76489e75c30881aa0425a0e4d9f3084956b57255f5c927e90c
SSDEEP

3072:4fyTFpiSc43UtiD8Umh8I6lk0bF+EjJeNDU2a7i78nifiRjdUw5cWBS:4flD4ktiD8UI8I66C+6AsXnifujF

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4884 2796 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4884	2796	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3028 wrote to memory of 2796	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 2796	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 2796	3028	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5489b800678c1a53773aac465b47514f1fc3f4dd71937a4e2983841585c53bdc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5489b800678c1a53773aac465b47514f1fc3f4dd71937a4e2983841585c53bdc.dll,#1
2⤵
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 632
3⤵
- Program crash
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2796 -ip 2796
1⤵
PID:3152