969f5504b98c1b7e0cc6834fb2ad60aa62255de2ed09f54c89cdede78ad97d9e

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 11:30

Target

969f5504b98c1b7e0cc6834fb2ad60aa62255de2ed09f54c89cdede78ad97d9e.dll
Size

2.1MB
MD5

00e929ffa99f05ddc5c9649189186ff5
SHA1

f84f4a2ae9d79f87dfc75f544c8722c36db805a0
SHA256

969f5504b98c1b7e0cc6834fb2ad60aa62255de2ed09f54c89cdede78ad97d9e
SHA512

d02593efec302a61fc52be7fb522557dba9a6be27f7972a10fecd5b4606e1dc50a26faae2132e311ec263dd5033678e6e05f4e1575699df409166717090078fd
SSDEEP

49152:vcz84B8m/mJoQcXJmomEfZOkNPSTqctjRTDpJMMB:k7qm/e4cCPSTqsL5B

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3456	4544	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 4544	2180	rundll32.exe	87
PID 2180 wrote to memory of 4544	2180	rundll32.exe	87
PID 2180 wrote to memory of 4544	2180	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\969f5504b98c1b7e0cc6834fb2ad60aa62255de2ed09f54c89cdede78ad97d9e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\969f5504b98c1b7e0cc6834fb2ad60aa62255de2ed09f54c89cdede78ad97d9e.dll,#1
  2⤵
  PID:4544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 560
    3⤵
    - Program crash
    PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4544 -ip 4544
1⤵
PID:1172