7273ce1dec7ed7e975207bd9472ef8b31a301b4901523e9dc4acc19bb86ee45d

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2023, 22:52

Target

7273ce1dec7ed7e975207bd9472ef8b31a301b4901523e9dc4acc19bb86ee45d.dll
Size

2.1MB
MD5

19cdb0bf5a0f9e6f4f34b31323045ad2
SHA1

ae41f25c1b945ef8048dc8031242e4b1fd9373fb
SHA256

7273ce1dec7ed7e975207bd9472ef8b31a301b4901523e9dc4acc19bb86ee45d
SHA512

4fe6a17eb3256e3d81c1b96311ad7ec006c5de598239beba4375862ee1908707524c3611c98637644d4c2610fb6303b56fc98fb3674697b4855237c80bfc33b3
SSDEEP

49152:vcz84B8m/mJtQAXJmWmEfZOkNPSTqctjRTDpJMMD8:k7qm/lMcQPSTqsL5D8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2096	1800	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1800	1452	rundll32.exe	82
PID 1452 wrote to memory of 1800	1452	rundll32.exe	82
PID 1452 wrote to memory of 1800	1452	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7273ce1dec7ed7e975207bd9472ef8b31a301b4901523e9dc4acc19bb86ee45d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7273ce1dec7ed7e975207bd9472ef8b31a301b4901523e9dc4acc19bb86ee45d.dll,#1
  2⤵
  PID:1800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 560
    3⤵
    - Program crash
    PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1800 -ip 1800
1⤵
PID:3804