29bd60287f34fbce0df52c723ad1afbcb8636d5fb2edc8d38c8ee408939dbc4d

Analysis

max time kernel
167s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2023 07:13

Target

29bd60287f34fbce0df52c723ad1afbcb8636d5fb2edc8d38c8ee408939dbc4d.dll
Size

95KB
MD5

309c1100a18fa0395b8d123900b737e3
SHA1

14a4e267258d607548e52145e83445f3893e3bb4
SHA256

29bd60287f34fbce0df52c723ad1afbcb8636d5fb2edc8d38c8ee408939dbc4d
SHA512

591f685528dc327bc18340b620f10bb13917f4c3585a9233719618a5a426ade1b7c9a33b8d70ad79636de166cb6334f3cac4ea2ed8be161b0d1f99bb9044ed5e
SSDEEP

1536:q0SBNmUFGbAF1CWGkC14HgjcH/7BxBrl08PGaBdm9m+0mckVPxIiThkuASUus:rSBNibrWz04AjG7BxBrPPGaBdqzckVP8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2288	2840	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2840	rundll32.exe
2840	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2840	1748	rundll32.exe	84
PID 1748 wrote to memory of 2840	1748	rundll32.exe	84
PID 1748 wrote to memory of 2840	1748	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29bd60287f34fbce0df52c723ad1afbcb8636d5fb2edc8d38c8ee408939dbc4d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\29bd60287f34fbce0df52c723ad1afbcb8636d5fb2edc8d38c8ee408939dbc4d.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 608
    3⤵
    - Program crash
    PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2840 -ip 2840
1⤵
PID:2884

memory/2840-1-0x0000000075450000-0x000000007546B000-memory.dmp

Filesize
108KB

Download
memory/2840-0-0x0000000075450000-0x000000007546B000-memory.dmp

Filesize
108KB

Download
memory/2840-2-0x0000000075450000-0x000000007546B000-memory.dmp

Filesize
108KB

Download