017bdce63a68f95fa9c80cb80b86e7c5ab35128e78768b8294b1b805e0629329

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 21:01

Target

017bdce63a68f95fa9c80cb80b86e7c5ab35128e78768b8294b1b805e0629329.dll
Size

4.2MB
MD5

55a761b66f01b2fc1585c10487e865d7
SHA1

b1d23d511447bb4731c5e48737f7664361ce2bca
SHA256

017bdce63a68f95fa9c80cb80b86e7c5ab35128e78768b8294b1b805e0629329
SHA512

e310fc26affe13f2d10d91fd9268f3012dd7bc0027adc9ce3a76e399fc66ceaaced8d4e6687618fcd6f45a9d908026cedf8cb9e4c5816fe545c6071d39ad9116
SSDEEP

49152:4+ucBYMm+YKeOiWJQ24jfWcMuGfEMw6m/qsAm7UZTzgYdaiTL/D:ruyYMVYKe2JIjfWD7ZrmSshiz3auLr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1940	1244	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 1244	3768	rundll32.exe	25
PID 3768 wrote to memory of 1244	3768	rundll32.exe	25
PID 3768 wrote to memory of 1244	3768	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\017bdce63a68f95fa9c80cb80b86e7c5ab35128e78768b8294b1b805e0629329.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\017bdce63a68f95fa9c80cb80b86e7c5ab35128e78768b8294b1b805e0629329.dll,#1
  2⤵
  PID:1244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 632
    3⤵
    - Program crash
    PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1244 -ip 1244
1⤵
PID:1228

memory/1244-0-0x0000000010000000-0x0000000010428000-memory.dmp

Filesize
4.2MB

Download
memory/1244-1-0x0000000076230000-0x0000000076445000-memory.dmp

Filesize
2.1MB

Download