1129d65129af4c82257509198fa9f809392f8d7c4d676f7fd5026848c3c8fa71

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2023, 12:55

Target
1129d65129af4c82257509198fa9f809392f8d7c4d676f7fd5026848c3c8fa71.dll
Size 720KB
Sample231113-p57xcsdb96
SHA256 1129d65129af4c82257509198fa9f809392f8d7c4d676f7fd5026848c3c8fa71
MD5 d6dfe7c2d497e42a2a623909428afa18
SHA1 44751a0b81b3a69c02db5be04ad6756628f0a905
SHA512 54f20f42e680f0ae95cd514d5d7560f1aeb00f99c2ed2b7898809ff1f361be646f73f555e7692e7c395e7227d501e73fd29a1bab2f50b7a9fa929aed03599a76
SSDEEP 12288:l+MbFpyhfFNZ2kW32pVqv+dEAy8v4m7e0Y5tK9n1o7X/NWWK2QwXL9s0:HFpyh1BC3Qe0g4n+v4XCL60
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	4460	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4460	3372	rundll32.exe	85
PID 3372 wrote to memory of 4460	3372	rundll32.exe	85
PID 3372 wrote to memory of 4460	3372	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1129d65129af4c82257509198fa9f809392f8d7c4d676f7fd5026848c3c8fa71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1129d65129af4c82257509198fa9f809392f8d7c4d676f7fd5026848c3c8fa71.dll,#1
  2⤵
  PID:4460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 716
    3⤵
    - Program crash
    PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4460 -ip 4460
1⤵
PID:2260