ba0e4bfbc558a168d0a4c2cca04646f590f9ee6e0a1bf25279ce9ce2e080567d

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 10:51

Target

ba0e4bfbc558a168d0a4c2cca04646f590f9ee6e0a1bf25279ce9ce2e080567d.dll
Size

2.1MB
MD5

0b2b2bcc76e8d823eb9d5b766f7082c6
SHA1

99e5b1679358c8d2268eef0b2085dbceec26cb4d
SHA256

ba0e4bfbc558a168d0a4c2cca04646f590f9ee6e0a1bf25279ce9ce2e080567d
SHA512

3ae397f21f8e4bb912a7c71d2f517f622db2cc40100183b6af2c2be90d6bb6d1c10455f104e091e69176eda0da9f48f309436fd4b1734b8e42d5eaf237cbf01b
SSDEEP

49152:viz84B8m/mJoQAXJmomEfZOkNPSTqctjRTDpJMMU:67qm/eMcCPSTqsL5U

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4844	3912	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 3912	1784	rundll32.exe	82
PID 1784 wrote to memory of 3912	1784	rundll32.exe	82
PID 1784 wrote to memory of 3912	1784	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba0e4bfbc558a168d0a4c2cca04646f590f9ee6e0a1bf25279ce9ce2e080567d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba0e4bfbc558a168d0a4c2cca04646f590f9ee6e0a1bf25279ce9ce2e080567d.dll,#1
  2⤵
  PID:3912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 560
    3⤵
    - Program crash
    PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3912 -ip 3912
1⤵
PID:3288