00eb870477f3d9007c1ff885216219cc111ee9365f5e3d70f7bd37bd44910493

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 17:01

Target

00eb870477f3d9007c1ff885216219cc111ee9365f5e3d70f7bd37bd44910493.dll
Size

2.1MB
MD5

b3e65bbadc38a58915e4335fa0ec9442
SHA1

58ec2852ed48ee738810187e08e70acac47c9002
SHA256

00eb870477f3d9007c1ff885216219cc111ee9365f5e3d70f7bd37bd44910493
SHA512

e2d6c73c4ea9e26a743bd7b1c25cdda18f40686172b708506dadbfbda16d2e270b9e47f10974d2533e471bdf0708dab609818d779807bbb6828e05d4c34d29e9
SSDEEP

49152:vjz84B8m/mJoQAXJm5mEfZOkNPSTqctjRTDpJMMM:r7qm/eMcPPSTqsL5M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4668	3336	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 3336	756	rundll32.exe	81
PID 756 wrote to memory of 3336	756	rundll32.exe	81
PID 756 wrote to memory of 3336	756	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00eb870477f3d9007c1ff885216219cc111ee9365f5e3d70f7bd37bd44910493.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00eb870477f3d9007c1ff885216219cc111ee9365f5e3d70f7bd37bd44910493.dll,#1
  2⤵
  PID:3336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 560
    3⤵
    - Program crash
    PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3336 -ip 3336
1⤵
PID:1008