53affb714e415454812ab19b140ec5efe884d2751485f36230a3cc732da82eae

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2023, 12:02

Target

53affb714e415454812ab19b140ec5efe884d2751485f36230a3cc732da82eae.dll
Size

2.2MB
MD5

e09093e2a3b3139f9e9c03491f5117f6
SHA1

576dc2976b8f2a4911e915c310f0dde1e172c78d
SHA256

53affb714e415454812ab19b140ec5efe884d2751485f36230a3cc732da82eae
SHA512

cb76e0b625de4f78d4582e7c079156a1382d819458b7d9963036d1e4604727b10930c21949a35507cd6a8509ff3955991b1ecb5f56c91f015e9c22a516bde1f4
SSDEEP

49152:TJd0OM5Fym/8RgJ1YM97tQjFozL19wNa/Wgq:VCOM5WyJ4jFKp9JWgq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	1980	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1980	2236	rundll32.exe	83
PID 2236 wrote to memory of 1980	2236	rundll32.exe	83
PID 2236 wrote to memory of 1980	2236	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53affb714e415454812ab19b140ec5efe884d2751485f36230a3cc732da82eae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\53affb714e415454812ab19b140ec5efe884d2751485f36230a3cc732da82eae.dll,#1
  2⤵
  PID:1980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 564
    3⤵
    - Program crash
    PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1980 -ip 1980
1⤵
PID:4820