9f291cffe3897c2d2c681e87d8daed4c9253d3b2e92a6d2e7f86b5d810ceb998

Analysis

max time kernel
128s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 09:53

Target

17112023_1753_cqo6op3_a44n26.dll
Size

196KB
MD5

e7d12aa6efc2987dabe2aaeec35022a0
SHA1

c2f3da1d92cc2aa0798c406d4a0cb860aaec9afe
SHA256

9f291cffe3897c2d2c681e87d8daed4c9253d3b2e92a6d2e7f86b5d810ceb998
SHA512

354cf1fecbaae13350aa67eccff0353e4d3a8a9b4764a868259c49426ee1f01d4be51b79d23d4141a9bd63da80f92df9d27c4df17aac400353f6be3eb1273e28
SSDEEP

3072:D9HvdBLNdtOQEMLJBYA6yZWE1nt+0UQ111OSvkVdkGOtV:D9P/xeVMLrYA6tqNzHvWY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2300	924	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 924	2788	rundll32.exe	86
PID 2788 wrote to memory of 924	2788	rundll32.exe	86
PID 2788 wrote to memory of 924	2788	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17112023_1753_cqo6op3_a44n26.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17112023_1753_cqo6op3_a44n26.dll,#1
  2⤵
  PID:924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 596
    3⤵
    - Program crash
    PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 924 -ip 924
1⤵
PID:1716