b0623b791beaec60b99d2d3f2d03c31e2a3bbe18ea1e78c4bc60b4115f8e920c

Analysis

max time kernel
135s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2023 03:34

Target

b0623b791beaec60b99d2d3f2d03c31e2a3bbe18ea1e78c4bc60b4115f8e920c.dll
Size

208KB
MD5

c0c9e8493ac55c1d1d66eba7adf4c449
SHA1

32a5c25bcc793f48f2cf20620da298f4bc52e118
SHA256

b0623b791beaec60b99d2d3f2d03c31e2a3bbe18ea1e78c4bc60b4115f8e920c
SHA512

b1f9e0b3fedeb80efe2385691a2b8682beaef87e25c38eeb6cd9040dccacd7c4ec25cf33f3869e7a6ab6585fa0d34eddb882050fa0e1d36f7971c63adaaa2b1d
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdU/Y5K:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5020 4452 WerFault.exe rundll32.exe

pid	pid_target	process	target process
5020	4452	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3188 wrote to memory of 4452	3188	rundll32.exe	rundll32.exe
PID 3188 wrote to memory of 4452	3188	rundll32.exe	rundll32.exe
PID 3188 wrote to memory of 4452	3188	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0623b791beaec60b99d2d3f2d03c31e2a3bbe18ea1e78c4bc60b4115f8e920c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3188

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0623b791beaec60b99d2d3f2d03c31e2a3bbe18ea1e78c4bc60b4115f8e920c.dll,#1
2⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 632
3⤵
- Program crash
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4452 -ip 4452
1⤵
PID:1624