dca07b54cea3b995b2135cbaf3b73370b815530605196787b8e4099c03309b8a

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 01:22

Target

dca07b54cea3b995b2135cbaf3b73370b815530605196787b8e4099c03309b8a.dll
Size

208KB
MD5

4cd9b633ba45bb7fe98dd5860ad8a47c
SHA1

8f83583e9ac3ffde2ab16fd26a0af2a70b6b9ddb
SHA256

dca07b54cea3b995b2135cbaf3b73370b815530605196787b8e4099c03309b8a
SHA512

4c65cb6385d65a8fe24795cf8d3d25bb7835293006b01be80c38380edba6a5b538c03f97bf9ad9a740448498421b12b284aabda8694f60f0006945b6623d9676
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUDY5a:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5064 5012 WerFault.exe rundll32.exe

pid	pid_target	process	target process
5064	5012	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5076 wrote to memory of 5012	5076	rundll32.exe	rundll32.exe
PID 5076 wrote to memory of 5012	5076	rundll32.exe	rundll32.exe
PID 5076 wrote to memory of 5012	5076	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dca07b54cea3b995b2135cbaf3b73370b815530605196787b8e4099c03309b8a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5076

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dca07b54cea3b995b2135cbaf3b73370b815530605196787b8e4099c03309b8a.dll,#1
2⤵
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 632
3⤵
- Program crash
PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 5012 -ip 5012
1⤵
PID:2516