e039181765850d9d681acfa6e936282211b15601d37791fcdb7ebf1f32297009

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 05:24

Target

e039181765850d9d681acfa6e936282211b15601d37791fcdb7ebf1f32297009.dll
Size

2.8MB
MD5

f2aefe9be195cd38df050f7e2a691d1c
SHA1

dc496ff722716cef6812d5d753323f297ace9c96
SHA256

e039181765850d9d681acfa6e936282211b15601d37791fcdb7ebf1f32297009
SHA512

dc932054ee0ef77d42c7983fb0d7b931b7aedf31401a0f655fc34bd0b443c92f2f6f01107b8a7e1151296ef5e724586c23809dce6f8d19b77b28b095b3eb1cf3
SSDEEP

49152:88bvd1uf1VJM7NnaUhEehiArugE+T5i9F8n/Y5X8Tl/TjEccFsUVUP3OO0:TbFgf1DsaUhEgiAKx0i9Fm/xEccsP3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1376	4396	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 4396	2228	rundll32.exe	86
PID 2228 wrote to memory of 4396	2228	rundll32.exe	86
PID 2228 wrote to memory of 4396	2228	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e039181765850d9d681acfa6e936282211b15601d37791fcdb7ebf1f32297009.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e039181765850d9d681acfa6e936282211b15601d37791fcdb7ebf1f32297009.dll,#1
  2⤵
  PID:4396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 660
    3⤵
    - Program crash
    PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4396 -ip 4396
1⤵
PID:1476