ab575663a0f9660d2af206f88bd98dfe426a8273606e1b1c73ce42dd2e36c797

Analysis

max time kernel
128s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2023, 18:38

Target

ab575663a0f9660d2af206f88bd98dfe426a8273606e1b1c73ce42dd2e36c797.dll
Size

2.2MB
MD5

02708640fdceffb03f94d7dc0078a9cc
SHA1

108a180f0f4f26c7b1b45879e99dbc8e077212fd
SHA256

ab575663a0f9660d2af206f88bd98dfe426a8273606e1b1c73ce42dd2e36c797
SHA512

565da0a5a37a77523976780b6f147c08892f8322dd783cad7771dd7b9573db5bf8889facb298eb61b8200f32628ed1565385cab8b48a20a5fe5ec18b6707d7a5
SSDEEP

49152:TJd0OM5FyT/8RgJFYM97tQjFozL19wNa/WgUZ:VCOM5FyJIjFKp9JWgW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3920	1160	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 1160	4460	rundll32.exe	82
PID 4460 wrote to memory of 1160	4460	rundll32.exe	82
PID 4460 wrote to memory of 1160	4460	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab575663a0f9660d2af206f88bd98dfe426a8273606e1b1c73ce42dd2e36c797.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab575663a0f9660d2af206f88bd98dfe426a8273606e1b1c73ce42dd2e36c797.dll,#1
  2⤵
  PID:1160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 564
    3⤵
    - Program crash
    PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1160 -ip 1160
1⤵
PID:4244