37fc8926a1e52e11a247fbc28c4a05ec5125e1d17c5344bebd53a82cd703a904

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2023 17:01

Target

37fc8926a1e52e11a247fbc28c4a05ec5125e1d17c5344bebd53a82cd703a904.dll
Size

200KB
MD5

8a0261e819d46a89a327e08742de9ee5
SHA1

04895a479a345f504f11bbb7a47c13b93dd3ac6a
SHA256

37fc8926a1e52e11a247fbc28c4a05ec5125e1d17c5344bebd53a82cd703a904
SHA512

9fa78e33fad23af72c64f5e9ecfd92140fcfc668063926e1223bdfc3fd97f0a2c5a8dfbb4e88abbdf78f6a9cd918c3ae672d378fdefd0f7c70d469e538b0ef25
SSDEEP

3072:1n5hItSqz8/T5wfLgwyHZKis17J/BRbU7pninIDmwr73Fp1cntw/cTiX:L2tR8/T5wTgwziqZRWiZy/v

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2288	3256	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 3256	1156	rundll32.exe	85
PID 1156 wrote to memory of 3256	1156	rundll32.exe	85
PID 1156 wrote to memory of 3256	1156	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37fc8926a1e52e11a247fbc28c4a05ec5125e1d17c5344bebd53a82cd703a904.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37fc8926a1e52e11a247fbc28c4a05ec5125e1d17c5344bebd53a82cd703a904.dll,#1
  2⤵
  PID:3256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 612
    3⤵
    - Program crash
    PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3256 -ip 3256
1⤵
PID:3856