526c72238adcc8da9147ddba55eb2b235c0ac430b997b4354823b4cad65bff0c

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2023, 17:25

Target

526c72238adcc8da9147ddba55eb2b235c0ac430b997b4354823b4cad65bff0c.dll
Size

90KB
MD5

93c8fa20540ad2d63ee520d20622ddbe
SHA1

76528bc40a8d6bdd6f67121d6f60bfbd41b2680c
SHA256

526c72238adcc8da9147ddba55eb2b235c0ac430b997b4354823b4cad65bff0c
SHA512

7a7fe3cfa0b06a85fb706960a1120ffa9b1ea0e98d0e25c6a645558d636cb65369fcad1c46b5106edb5debbc72cb592c7667f03803d126c6c50ccee9db20fac2
SSDEEP

768:IXcUGuwTDr8K1LaglGDEM+0ePPFdR9NYt:KYHLaglGIM7uddHNYt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2980	3204	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 3204	3404	rundll32.exe	83
PID 3404 wrote to memory of 3204	3404	rundll32.exe	83
PID 3404 wrote to memory of 3204	3404	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\526c72238adcc8da9147ddba55eb2b235c0ac430b997b4354823b4cad65bff0c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\526c72238adcc8da9147ddba55eb2b235c0ac430b997b4354823b4cad65bff0c.dll,#1
  2⤵
  PID:3204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 616
    3⤵
    - Program crash
    PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3204 -ip 3204
1⤵
PID:1044

memory/3204-0-0x0000000074A90000-0x0000000074AA1000-memory.dmp

Filesize
68KB

Download