804693ea1072aec71d8c054716386546c1cd594a907e089227ea5c91f0f8725f

Analysis

max time kernel
161s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 17:56

Target

804693ea1072aec71d8c054716386546c1cd594a907e089227ea5c91f0f8725f.dll
Size

4.8MB
MD5

00bacb8be24f9c3b60b248cd106ec117
SHA1

1c24872858a629166089d45e4ae002b59f72c9bf
SHA256

804693ea1072aec71d8c054716386546c1cd594a907e089227ea5c91f0f8725f
SHA512

47ce68caab42ade22d263b0fa3a7771328381e00d7cef6a736cd1c6643cd764ae4e60b658c22b92decd8025fc9648ae336b50e19fdd4bbc77496a97230cfbf28
SSDEEP

98304:c6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww4:UsLzKtOa6g5k5yLUGm13lBf/JK5GaSh5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
532	3348	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 3348	540	rundll32.exe	85
PID 540 wrote to memory of 3348	540	rundll32.exe	85
PID 540 wrote to memory of 3348	540	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\804693ea1072aec71d8c054716386546c1cd594a907e089227ea5c91f0f8725f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\804693ea1072aec71d8c054716386546c1cd594a907e089227ea5c91f0f8725f.dll,#1
  2⤵
  PID:3348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 560
    3⤵
    - Program crash
    PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3348 -ip 3348
1⤵
PID:764