e563cc777061f1943dd92cb64af239768ea3de201c8d422646d5931125d03697

Analysis

max time kernel
188s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2023 18:45

Target

e563cc777061f1943dd92cb64af239768ea3de201c8d422646d5931125d03697.dll
Size

208KB
MD5

33de9886a686b2b863a6e5a97a867b69
SHA1

f25dfc6390a54bf2ac51afadb135e52057536160
SHA256

e563cc777061f1943dd92cb64af239768ea3de201c8d422646d5931125d03697
SHA512

298a5e89e00b96619e6e45fe90905dbacead0262f0659ef54ebf53c6def3fd215f96f7fc674d263e3adbbcd931ff55001e225bafe460c5e0946f415e2c73135c
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdULY57mcj:LIDff9D8C6XYRw6MT2DEj4cj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5020 3260 WerFault.exe rundll32.exe

pid	pid_target	process	target process
5020	3260	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2880 wrote to memory of 3260	2880	rundll32.exe	rundll32.exe
PID 2880 wrote to memory of 3260	2880	rundll32.exe	rundll32.exe
PID 2880 wrote to memory of 3260	2880	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e563cc777061f1943dd92cb64af239768ea3de201c8d422646d5931125d03697.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e563cc777061f1943dd92cb64af239768ea3de201c8d422646d5931125d03697.dll,#1
2⤵
PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 632
3⤵
- Program crash
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3260 -ip 3260
1⤵
PID:4024