d97ad171845e803038f9bb5239d104f2fedde1fc8b75fea78e36d937cf56869b

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2023, 10:50

Target

d97ad171845e803038f9bb5239d104f2fedde1fc8b75fea78e36d937cf56869b.dll
Size

1.1MB
MD5

2ae5407d6700e24638ef952b5ac69262
SHA1

a2036a8ecd83b5560bcd69560a698f6db05af1c0
SHA256

d97ad171845e803038f9bb5239d104f2fedde1fc8b75fea78e36d937cf56869b
SHA512

5a6e18185e7cf9d5e461e5e5560c191b95f395a30cd2374729042373d155894d89fabe0184ce78683ad26c5c0d02dfd511b09837ebda15345b3e8faabde6bb4f
SSDEEP

24576:+k4z4NnZpRhOFLdTymr0mnQ8MllbXSSgzbyGED:+k4zinZYFhnImnrKbXhZGED

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2560	3080	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 3080	4556	rundll32.exe	85
PID 4556 wrote to memory of 3080	4556	rundll32.exe	85
PID 4556 wrote to memory of 3080	4556	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d97ad171845e803038f9bb5239d104f2fedde1fc8b75fea78e36d937cf56869b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d97ad171845e803038f9bb5239d104f2fedde1fc8b75fea78e36d937cf56869b.dll,#1
  2⤵
  PID:3080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 924
    3⤵
    - Program crash
    PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3080 -ip 3080
1⤵
PID:884