9839093e3984fd86428b3aebbd7e4e48eb647144421db092d4e35d3a65aaf4b9

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 12:49

Target

9839093e3984fd86428b3aebbd7e4e48eb647144421db092d4e35d3a65aaf4b9.dll
Size

2.1MB
MD5

d8f756811703c9a8d0ddfb656a760eaf
SHA1

fb4df95c30814f74db308e44325ca4c34f98d7c2
SHA256

9839093e3984fd86428b3aebbd7e4e48eb647144421db092d4e35d3a65aaf4b9
SHA512

eaefb72bb23be1678fb6b274fe51dc20e03ddbcd8cd15587f9ee7152bcb54d89188db6bd1624524be12894584046dd98f5eecb3db4f6cf11c125d94a1661cb07
SSDEEP

49152:y8feI79r2xUrHv31PVbhJ/P0BDpinATs75a78th:y8D7R2U/tqBDpgh08th

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2220	3592	WerFault.exe	85
4440	3592	WerFault.exe	85

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 3592	4888	rundll32.exe	85
PID 4888 wrote to memory of 3592	4888	rundll32.exe	85
PID 4888 wrote to memory of 3592	4888	rundll32.exe	85
PID 3592 wrote to memory of 4440	3592	rundll32.exe	91
PID 3592 wrote to memory of 4440	3592	rundll32.exe	91
PID 3592 wrote to memory of 4440	3592	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9839093e3984fd86428b3aebbd7e4e48eb647144421db092d4e35d3a65aaf4b9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9839093e3984fd86428b3aebbd7e4e48eb647144421db092d4e35d3a65aaf4b9.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 564
    3⤵
    - Program crash
    PID:2220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 564
    3⤵
    - Program crash
    PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3592 -ip 3592
1⤵
PID:896