06ac60dd14b4e99f52e9be202ae7466a8ad2a828a04d14bfb7a512e715d009bf

Analysis

max time kernel
144s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 07:30

Target

06ac60dd14b4e99f52e9be202ae7466a8ad2a828a04d14bfb7a512e715d009bf.dll
Size

218KB
MD5

646a20e0d0e380c7b75a3c44c95ee931
SHA1

48c93e6ec058164f6ec5228546392eee2f4d6744
SHA256

06ac60dd14b4e99f52e9be202ae7466a8ad2a828a04d14bfb7a512e715d009bf
SHA512

5e535541d5930521b29a8cbfa40eab25c57f006e3d1fd80e0499e15bf350ba8e4d34119d5f1f0b9fbbe11174978f33c2c626f9affe7f3ff4b49dd6f49e6f0ad5
SSDEEP

3072:tfyTFpXSc43UtiD8Umh8I6lk0bF+EjJeNDU2a7i78nifiRjdURZ52eBS:tfsD4ktiD8UI8I66C+6AsXnifujkh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2176	3856	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 3856	4140	rundll32.exe	86
PID 4140 wrote to memory of 3856	4140	rundll32.exe	86
PID 4140 wrote to memory of 3856	4140	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06ac60dd14b4e99f52e9be202ae7466a8ad2a828a04d14bfb7a512e715d009bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06ac60dd14b4e99f52e9be202ae7466a8ad2a828a04d14bfb7a512e715d009bf.dll,#1
  2⤵
  PID:3856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 632
    3⤵
    - Program crash
    PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3856 -ip 3856
1⤵
PID:3424