cf4c33431fd68cc6f8130cdc45392096a212925c7187317db31f7b1f4f268a48

Analysis

max time kernel
149s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 02:33

Target

cf4c33431fd68cc6f8130cdc45392096a212925c7187317db31f7b1f4f268a48.dll
Size

2.1MB
MD5

ccc4c4e549e202ba8ee638dcfb085cf6
SHA1

4f47da398f6c68ce50699a0998b56406381cba3d
SHA256

cf4c33431fd68cc6f8130cdc45392096a212925c7187317db31f7b1f4f268a48
SHA512

b19041f1fa01c17540048d23536e4ff17866490ff1bd314f3fec9f76e3ae7b6e721ea99ae65b8a0f2d75a58effc6ecd90d0a6b1947ad62d3d90e3226487b54f2
SSDEEP

49152:vcz84B8m/NJoQAXJmXmEfZOkNPSTqctjRTDpJMMt:k7qm/NMcNPSTqsL5t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1440	2732	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2732	1916	rundll32.exe	85
PID 1916 wrote to memory of 2732	1916	rundll32.exe	85
PID 1916 wrote to memory of 2732	1916	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf4c33431fd68cc6f8130cdc45392096a212925c7187317db31f7b1f4f268a48.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf4c33431fd68cc6f8130cdc45392096a212925c7187317db31f7b1f4f268a48.dll,#1
  2⤵
  PID:2732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 560
    3⤵
    - Program crash
    PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2732 -ip 2732
1⤵
PID:4588