c5fee5ea851a2bae1d1fae4cd4086b3269dcf0510270fb63be862f0903da6237

Analysis

max time kernel
140s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 14:00

Target

e9cace18923b153625052e9aba3ee7cf793d5a40c11a23fa3e1bab1794349b3b.dll
Size

124KB
MD5

f36470d54057f976466a5abbc5241a9b
SHA1

0e7e31c03fee215ac15d59a32f7e62501b2f9eb4
SHA256

e9cace18923b153625052e9aba3ee7cf793d5a40c11a23fa3e1bab1794349b3b
SHA512

1559b5fbfebdb463397295d332ff8d6cf7b3a3b152ccbbdf80c2b17780658e4c1b71da7f2debb32d81999094cae8f572e77b617aa56e83158751f4abd532f3ed
SSDEEP

1536:jTP8ZJWpcqPFiyOWX3oes01vFUJrdgspucawz5NhjKgwPEOMp3aaovJ9:jw5qPF7OS3zslJrHawz5NhDw0laaCJ9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2492	2404	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2404	1380	rundll32.exe	81
PID 1380 wrote to memory of 2404	1380	rundll32.exe	81
PID 1380 wrote to memory of 2404	1380	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9cace18923b153625052e9aba3ee7cf793d5a40c11a23fa3e1bab1794349b3b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e9cace18923b153625052e9aba3ee7cf793d5a40c11a23fa3e1bab1794349b3b.dll,#1
  2⤵
  PID:2404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 544
    3⤵
    - Program crash
    PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2404 -ip 2404
1⤵
PID:1776