a1045b4c6a7e0a05ca7314f96b00ccb10246dceb0c849d7c61134e785d2baed3

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2023, 21:46

Target

a1045b4c6a7e0a05ca7314f96b00ccb10246dceb0c849d7c61134e785d2baed3.dll
Size

1.2MB
MD5

457d653fddc5470c070d932452f0dd72
SHA1

466acadb97ff069c66ca99ab5d1a14178177f9de
SHA256

a1045b4c6a7e0a05ca7314f96b00ccb10246dceb0c849d7c61134e785d2baed3
SHA512

a5bfbddd0847c38e41b1273129896724ad5c5bb5c455b48d407c00f3361f09ac77a6a274a615dc9da4272a5e167c807f4f0ba9a61c7a198be5baf8b0dc4b7d73
SSDEEP

24576:S1yZEiuOPIwB0YiBpsWTZ8splJKLj0hozO:S1yhvYBz18SJ7ozO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2448	2752	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2752	2636	rundll32.exe	82
PID 2636 wrote to memory of 2752	2636	rundll32.exe	82
PID 2636 wrote to memory of 2752	2636	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1045b4c6a7e0a05ca7314f96b00ccb10246dceb0c849d7c61134e785d2baed3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1045b4c6a7e0a05ca7314f96b00ccb10246dceb0c849d7c61134e785d2baed3.dll,#1
  2⤵
  PID:2752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 584
    3⤵
    - Program crash
    PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2752 -ip 2752
1⤵
PID:4936

memory/2752-0-0x0000000074950000-0x0000000074A85000-memory.dmp

Filesize
1.2MB

Download
memory/2752-1-0x0000000075110000-0x0000000075325000-memory.dmp

Filesize
2.1MB

Download