6ec79179c1e61df21e38b754017b672d559f0537ce0a3b64afe7df97025fd01d

Analysis

max time kernel
1682s
max time network
1156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2023, 10:38

Target

rousrDissonance.dll
Size

319KB
MD5

49069a0ab0892d2a4b1f5ff114571b5c
SHA1

f75c3ef3b3da8fe182307ebf650bf0aa05678429
SHA256

02224a4afa548de7b409d515dc4e9e7c5a60653f432639c568140a05cf84f045
SHA512

557f6e2fff9b11bbf5e3508fbd871b8d4d14a619e11b17738c414903412ec80d6b7f74f80a3d80cbff7956fbe0f83453f03d49edb1550d35a6754638a33c5cb1
SSDEEP

6144:nf5qHW95s2TtMMAvqaBPsku69/Y16iBRe1KLJ2r1Y0bw5aU0eTVza5q/+uPGhIJC:jMMAvqaBPst6e16XULy1Y0Dela5qzO2Q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	1000	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 1000	376	rundll32.exe	86
PID 376 wrote to memory of 1000	376	rundll32.exe	86
PID 376 wrote to memory of 1000	376	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rousrDissonance.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\rousrDissonance.dll,#1
  2⤵
  PID:1000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 612
    3⤵
    - Program crash
    PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1000 -ip 1000
1⤵
PID:2440