3e30b0d7b285fba5932b21a1a432c94aa486dee7cf04a10cdf472819e5e65438

Analysis

max time kernel
161s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2023 22:36

Target

3e30b0d7b285fba5932b21a1a432c94aa486dee7cf04a10cdf472819e5e65438.dll
Size

2.1MB
MD5

5d404d85e2d0b3384dd2190e7894964e
SHA1

e442a9756977d3ed71b1ebe44904b20cc32e1fa6
SHA256

3e30b0d7b285fba5932b21a1a432c94aa486dee7cf04a10cdf472819e5e65438
SHA512

f466e3d9300a4edc59abf01a3f23a0ab9a56f677328f476c97b1f4aaa6e28e1040e94b9e82ed858de514be426d0eaa06b262f2b538b6d3dd797de064629dc358
SSDEEP

49152:vcz84B8m/mJhQAXJmjmEfZOkNPSTqctjRTDpJMMe:k7qm/xMcpPSTqsL5e

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4180	1344	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1344	744	rundll32.exe	85
PID 744 wrote to memory of 1344	744	rundll32.exe	85
PID 744 wrote to memory of 1344	744	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e30b0d7b285fba5932b21a1a432c94aa486dee7cf04a10cdf472819e5e65438.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e30b0d7b285fba5932b21a1a432c94aa486dee7cf04a10cdf472819e5e65438.dll,#1
  2⤵
  PID:1344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 560
    3⤵
    - Program crash
    PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1344 -ip 1344
1⤵
PID:976