bdab97fe1a1e23af4ded8f4f1fa23c6224bdf1250b4198cb38d24ec2d1e25fac

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 15:08

Target

bdab97fe1a1e23af4ded8f4f1fa23c6224bdf1250b4198cb38d24ec2d1e25fac.dll
Size

2.1MB
MD5

cb5ab9c2d6a1de0de769779e0b4e1aad
SHA1

76820035560743046521fd87313fd69c2e467827
SHA256

bdab97fe1a1e23af4ded8f4f1fa23c6224bdf1250b4198cb38d24ec2d1e25fac
SHA512

df6858ca1c7205403e2883f6928280ff9b11d5824e120c3071faeac14e995cd51d95ab765b7bb8490724bd867b084b73da40faf404aa8eb70e9d5d1308ffbeba
SSDEEP

49152:vcz84o8m/mJoQAXJmQmEfZOkNPSTqctjRTDpJMM0:k7Fm/eMc6PSTqsL50

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4840	4740	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 4740	1952	rundll32.exe	82
PID 1952 wrote to memory of 4740	1952	rundll32.exe	82
PID 1952 wrote to memory of 4740	1952	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdab97fe1a1e23af4ded8f4f1fa23c6224bdf1250b4198cb38d24ec2d1e25fac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdab97fe1a1e23af4ded8f4f1fa23c6224bdf1250b4198cb38d24ec2d1e25fac.dll,#1
  2⤵
  PID:4740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 564
    3⤵
    - Program crash
    PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4740 -ip 4740
1⤵
PID:1604