180032f8413bd4e58a4b135f246f3a15737c0403dab4e5ced1af4be32cecf5e1

Analysis

max time kernel
139s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 15:54

Target

180032f8413bd4e58a4b135f246f3a15737c0403dab4e5ced1af4be32cecf5e1.dll
Size

1.9MB
MD5

4c771f9f585b40d9e82147272d675a4a
SHA1

b18097e86f2303b16b2aac0f2f736e779252655e
SHA256

180032f8413bd4e58a4b135f246f3a15737c0403dab4e5ced1af4be32cecf5e1
SHA512

598f9a0d78af752ff51d6a54c7350d11654311dead36461ae43ced2810680c4ccb514a62eb9067e246c1f4cb5f5cf3f7f35de2abcf04224a25c28b9fa70a9132
SSDEEP

49152:f7Xm3BjLDHOQ2XY4XCkJX0uOPp7NrcUTh9V4/9w:f7XYBjnuRXXXno7NrD5

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4300	548	WerFault.exe	86
4608	548	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 548	3552	rundll32.exe	86
PID 3552 wrote to memory of 548	3552	rundll32.exe	86
PID 3552 wrote to memory of 548	3552	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\180032f8413bd4e58a4b135f246f3a15737c0403dab4e5ced1af4be32cecf5e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\180032f8413bd4e58a4b135f246f3a15737c0403dab4e5ced1af4be32cecf5e1.dll,#1
  2⤵
  PID:548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 616
    3⤵
    - Program crash
    PID:4300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 836
    3⤵
    - Program crash
    PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 548 -ip 548
1⤵
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 548 -ip 548
1⤵
PID:2772