c513ebc530a9dce3f42131047abe02397966e2ea33f4bde231413fcdcfc07292

Analysis

max time kernel
191s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2023 21:02

Target

c513ebc530a9dce3f42131047abe02397966e2ea33f4bde231413fcdcfc07292.dll
Size

208KB
MD5

ba3bd1cf9f4559c81c7793acc96175ac
SHA1

7b95f4409fcb3ed57c8f32c8103ed650b1059d3d
SHA256

c513ebc530a9dce3f42131047abe02397966e2ea33f4bde231413fcdcfc07292
SHA512

14d7777fe3c694ec0001f4f9827fd08b52ff9234c670649ee21b16c1d943880ab40f780821f4d65d56e838a22cf358e99ec60ed98ca3c025c4fbd583a2f83be2
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUjY5vQ:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

116 1576 WerFault.exe rundll32.exe

pid	pid_target	process	target process
116	1576	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4392 wrote to memory of 1576	4392	rundll32.exe	rundll32.exe
PID 4392 wrote to memory of 1576	4392	rundll32.exe	rundll32.exe
PID 4392 wrote to memory of 1576	4392	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c513ebc530a9dce3f42131047abe02397966e2ea33f4bde231413fcdcfc07292.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4392

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c513ebc530a9dce3f42131047abe02397966e2ea33f4bde231413fcdcfc07292.dll,#1
2⤵
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 636
3⤵
- Program crash
PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1576 -ip 1576
1⤵
PID:2032