ecda30eaafd691488a6e62d602acdcb4c24bcbdb6a1cb9c1bdaa13f0a5b5a8d8

Analysis

max time kernel
136s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 03:59

Target

ecda30eaafd691488a6e62d602acdcb4c24bcbdb6a1cb9c1bdaa13f0a5b5a8d8.dll
Size

208KB
MD5

8f251e8b2afcf46b764dbfef86df3126
SHA1

e11bf2b0c91d469edac7945dcf037558b201a1db
SHA256

ecda30eaafd691488a6e62d602acdcb4c24bcbdb6a1cb9c1bdaa13f0a5b5a8d8
SHA512

c93a66ce4be2cc3735f16caff83c80074b0ce6897c411981b97f5a6e90e2bd4bdb3f3e8e24506a841656e953998860b5f27c078e614f4572e78612bdf3a0b0e2
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUyY5O:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1704 1624 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1704	1624	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2340 wrote to memory of 1624	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1624	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1624	2340	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecda30eaafd691488a6e62d602acdcb4c24bcbdb6a1cb9c1bdaa13f0a5b5a8d8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ecda30eaafd691488a6e62d602acdcb4c24bcbdb6a1cb9c1bdaa13f0a5b5a8d8.dll,#1
2⤵
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 632
3⤵
- Program crash
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1624 -ip 1624
1⤵
PID:1312