3caf045d94a1361f43d696a5388cd1722611abe53e2d65ab628ea0722de3021a

Analysis

max time kernel
177s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2023, 22:14

Target

3caf045d94a1361f43d696a5388cd1722611abe53e2d65ab628ea0722de3021a.dll
Size

2.1MB
MD5

eef0b0eb8c27661aa5637a6bdf99d2fa
SHA1

6cb6274142f71b052ec3c7690acc89bc97098069
SHA256

3caf045d94a1361f43d696a5388cd1722611abe53e2d65ab628ea0722de3021a
SHA512

ac44cd642e42600607b61fb16d26d7a125a55c9120e8073c269973fee76cf1c90948b54f99a5fc95c5b08e7b01fd60d77d3c50bd673e18da632626d7df054f8a
SSDEEP

49152:n8feI79oK2xUrHv31PmbhJ/P0BDpinATs75a78te:n8D7WK2U/tlBDpgh08te

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4520	4788	WerFault.exe	37

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4788	3372	rundll32.exe	37
PID 3372 wrote to memory of 4788	3372	rundll32.exe	37
PID 3372 wrote to memory of 4788	3372	rundll32.exe	37

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3caf045d94a1361f43d696a5388cd1722611abe53e2d65ab628ea0722de3021a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3caf045d94a1361f43d696a5388cd1722611abe53e2d65ab628ea0722de3021a.dll,#1
  2⤵
  PID:4788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 560
    3⤵
    - Program crash
    PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4788 -ip 4788
1⤵
PID:4220