27831c6f0ea87a651534a6863ef52f205aeb1f5b1688d2f1639dc594fdbacf48

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2023, 12:08

Target

27831c6f0ea87a651534a6863ef52f205aeb1f5b1688d2f1639dc594fdbacf48.dll
Size

2.1MB
MD5

1193d5e99be432e41dd4545f7549d55a
SHA1

82064ba76d1479efcd86d59e7dfad98287189eac
SHA256

27831c6f0ea87a651534a6863ef52f205aeb1f5b1688d2f1639dc594fdbacf48
SHA512

d6435e9560234e05eec8d3ef0f125d0f77a315606dee6d5aa16c0114ce71500473a3179bdb75220401c235e264adfb814a8e72dbc61a56c96ece47dc495f0b99
SSDEEP

49152:vcz84BSm/mJoQAXJmJmEfZOkNPSTqctjRTDpJMMU:k7Ym/eMcfPSTqsL5U

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2448	404	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 404	1756	rundll32.exe	87
PID 1756 wrote to memory of 404	1756	rundll32.exe	87
PID 1756 wrote to memory of 404	1756	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27831c6f0ea87a651534a6863ef52f205aeb1f5b1688d2f1639dc594fdbacf48.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27831c6f0ea87a651534a6863ef52f205aeb1f5b1688d2f1639dc594fdbacf48.dll,#1
  2⤵
  PID:404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 564
    3⤵
    - Program crash
    PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 404 -ip 404
1⤵
PID:4372