d399423ec72823d94eb090d43a12f7fa99b4e7c7278dc26b5b0ced97143bc76d

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2023, 20:01

Target

d399423ec72823d94eb090d43a12f7fa99b4e7c7278dc26b5b0ced97143bc76d.dll
Size

254KB
MD5

781c6a326062e264fe0db6aaf0009ece
SHA1

3b577d356a6b9a6d3b63cde90c1a481fba36ff3e
SHA256

d399423ec72823d94eb090d43a12f7fa99b4e7c7278dc26b5b0ced97143bc76d
SHA512

db78c0f4ac928faa85c0861738f33260bef7b8282140e9e5fa744a432f47ee8f4a86c553a96aafa1232cb2d51a2dceef9185b287bbe7c2086d4f91c3124efe2b
SSDEEP

3072:jxeZ6p7bxHSgOVNHGyHKmitOUpvSBjxRHSoQN9W8ei/b7h2jV+Hl9c2:l86p7gV5Gy1i/pwylN9Ww/bV2Kl9c

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	4116	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 4116	3004	rundll32.exe	82
PID 3004 wrote to memory of 4116	3004	rundll32.exe	82
PID 3004 wrote to memory of 4116	3004	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d399423ec72823d94eb090d43a12f7fa99b4e7c7278dc26b5b0ced97143bc76d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d399423ec72823d94eb090d43a12f7fa99b4e7c7278dc26b5b0ced97143bc76d.dll,#1
  2⤵
  PID:4116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 616
    3⤵
    - Program crash
    PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4116 -ip 4116
1⤵
PID:1664