dbb67e74918458095ee0900404070f3e141397e10dba30d4f5a8a30f5c2d0966

Analysis

max time kernel
186s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 01:34

Target

dbb67e74918458095ee0900404070f3e141397e10dba30d4f5a8a30f5c2d0966.dll
Size

234KB
MD5

683bc237391aa9ef9f532f3d71e995bf
SHA1

612a74cb245df8d7e5390d6e3819ba862ea04fd6
SHA256

dbb67e74918458095ee0900404070f3e141397e10dba30d4f5a8a30f5c2d0966
SHA512

b21973f78b7560ecc617eced89e82005d6e3a969bcd895d9ec259a6c781f1c3b5a48b4db6fc821d2ebd786530bb292174d56884f9ce99530e7d1895ee5a913a6
SSDEEP

3072:+3vli2EJv1RBuZH3JxgYhgipvLKoTte0SqoOCtA21/wlULGs7jnZdFjdUMN57O:+3vyJNRkZHBvZp0qoOCu2pkojnZHj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1220	4712	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 4712	1260	rundll32.exe	85
PID 1260 wrote to memory of 4712	1260	rundll32.exe	85
PID 1260 wrote to memory of 4712	1260	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbb67e74918458095ee0900404070f3e141397e10dba30d4f5a8a30f5c2d0966.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbb67e74918458095ee0900404070f3e141397e10dba30d4f5a8a30f5c2d0966.dll,#1
  2⤵
  PID:4712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 640
    3⤵
    - Program crash
    PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4712 -ip 4712
1⤵
PID:1216