2776fb126f92346f17883aa2a2f577eca473ca3efbcfa3464c9fe52f156d9db8

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 18:00

Target

2776fb126f92346f17883aa2a2f577eca473ca3efbcfa3464c9fe52f156d9db8.dll
Size

99KB
MD5

8be440c1db42c36a624b735d3c118539
SHA1

e0e196637b53b7f2bdea2faabf63d933e75ebaff
SHA256

2776fb126f92346f17883aa2a2f577eca473ca3efbcfa3464c9fe52f156d9db8
SHA512

c68ea980186314f17d2e9a73e6210cbfc9411f8ee7cd67c1058af6ff09ce882e6c7da361f672215f27aaf37fac4224fcd8cc01c366aeee38c3d0b25526340f12
SSDEEP

768:IDK8zrsBTYDjl7KJ1AQl5B+0egAoRn21STZCk4NYG:MkTAKSQlz7NkQZCrNYG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2540	4060	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 4060	3288	rundll32.exe	82
PID 3288 wrote to memory of 4060	3288	rundll32.exe	82
PID 3288 wrote to memory of 4060	3288	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2776fb126f92346f17883aa2a2f577eca473ca3efbcfa3464c9fe52f156d9db8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2776fb126f92346f17883aa2a2f577eca473ca3efbcfa3464c9fe52f156d9db8.dll,#1
  2⤵
  PID:4060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 592
    3⤵
    - Program crash
    PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4060 -ip 4060
1⤵
PID:1856

memory/4060-0-0x0000000074B30000-0x0000000074B40000-memory.dmp

Filesize
64KB

Download