1013c3e08ec730a198a19be1b6732221f9762bf2bfa49afeea092960a9785442

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 07:16

Target

1013c3e08ec730a198a19be1b6732221f9762bf2bfa49afeea092960a9785442.dll
Size

2.1MB
MD5

1bed3db262a05442fb0b8af4120b645a
SHA1

9b90ba6bc79d8001546790874017400feaa426d3
SHA256

1013c3e08ec730a198a19be1b6732221f9762bf2bfa49afeea092960a9785442
SHA512

414a9b376cfe6c09fa0f42fbc1dcfb0d0515dc453f2e6c30214f748df7d74af1aedeea2b2a29befe246e9ec2c6fedfc6d9a419af376a36ee2e55c05eff13370e
SSDEEP

49152:vcz84B8m/2JoQAXJm4mEfZOkNPSTqctjRTDpJMMj:k7qm/uMcSPSTqsL5j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4064	1120	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1120	1308	rundll32.exe	85
PID 1308 wrote to memory of 1120	1308	rundll32.exe	85
PID 1308 wrote to memory of 1120	1308	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1013c3e08ec730a198a19be1b6732221f9762bf2bfa49afeea092960a9785442.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1013c3e08ec730a198a19be1b6732221f9762bf2bfa49afeea092960a9785442.dll,#1
  2⤵
  PID:1120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 564
    3⤵
    - Program crash
    PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1120 -ip 1120
1⤵
PID:2120