b6269018ac32484bdc093a6bec324fc9aa7990104a297f55600d31bff95ed6fd

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2023 16:15

Target

i1v/zN/JI/eWJM/MVst/qI/1Q52/uURq/QIPJ/J4Xw/J6V/CO/bOs8/GMV/N53B/xSa.dll
Size

855KB
MD5

cf46f0cd591e50c425136470505e8a9e
SHA1

0e3d1488b9aa104aa0a39966132a70a47165aaef
SHA256

5a5154c5843a18d3912063b827ef541a709aec4132b847d75d7e634683acff8d
SHA512

3bddf5e233dbd8c4554c73050b0299892b7132afc1bdc67882daa309e0bf1767430aebade35977d06564f41477eeedb5840595cf2446e28d7d47d03179a1a5e4
SSDEEP

24576:v7UuAhS4VYKBOSR45LlxAh/uSLKAlr/A/cYV5fN:6/YVSulxb1AlurF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4748	4780	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4780	3480	rundll32.exe	85
PID 3480 wrote to memory of 4780	3480	rundll32.exe	85
PID 3480 wrote to memory of 4780	3480	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\i1v\zN\JI\eWJM\MVst\qI\1Q52\uURq\QIPJ\J4Xw\J6V\CO\bOs8\GMV\N53B\xSa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\i1v\zN\JI\eWJM\MVst\qI\1Q52\uURq\QIPJ\J4Xw\J6V\CO\bOs8\GMV\N53B\xSa.dll,#1
  2⤵
  PID:4780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 600
    3⤵
    - Program crash
    PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4780 -ip 4780
1⤵
PID:4912