3f89cdccec0d8205bc8b3df288610fa44f20af69eb780877f8ff088ac146b6d9

Analysis

max time kernel
142s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 21:41

Target

3f89cdccec0d8205bc8b3df288610fa44f20af69eb780877f8ff088ac146b6d9.dll
Size

2.1MB
MD5

868bf56dd2e41194da6481f4d616faff
SHA1

9cadcb8cf79efacd10b76e5a2203d8168403b020
SHA256

3f89cdccec0d8205bc8b3df288610fa44f20af69eb780877f8ff088ac146b6d9
SHA512

901c6de91b9b45ca50f72dd1380ee0eca09d767b7bdce202c9fc782374a87c467e22bcd3c98a492f02b101bafccb431a5d843c134ab08f1da93150ff97d8a5cf
SSDEEP

49152:y8feI7JroK2xUrHv31PRbhJ/P0BDpinATs75a78tD:y8D7JkK2U/t2BDpgh08tD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4768	2080	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2080	2252	rundll32.exe	88
PID 2252 wrote to memory of 2080	2252	rundll32.exe	88
PID 2252 wrote to memory of 2080	2252	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f89cdccec0d8205bc8b3df288610fa44f20af69eb780877f8ff088ac146b6d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f89cdccec0d8205bc8b3df288610fa44f20af69eb780877f8ff088ac146b6d9.dll,#1
  2⤵
  PID:2080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 560
    3⤵
    - Program crash
    PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2080 -ip 2080
1⤵
PID:3060