a6b64f6c0d2cdf795cce4b11cf54d806e8d4a7c7a2cc4b27ba0c9c143fbd9ca3

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2023 23:02

Target

a6b64f6c0d2cdf795cce4b11cf54d806e8d4a7c7a2cc4b27ba0c9c143fbd9ca3.dll
Size

2.0MB
MD5

dac0ea895b8048da299d083952e8ed90
SHA1

4de104c15fe52fe1b8fe06525f090583b4e7c25b
SHA256

a6b64f6c0d2cdf795cce4b11cf54d806e8d4a7c7a2cc4b27ba0c9c143fbd9ca3
SHA512

99b0a77352ce3eb509adeccdcc4a387e4893aee30dbbd42cbee15f7ed3bf3022c1ff79a0a04edc7a26e29155ebeae78a5829ab2875bf9245cf9b5c093e628ff8
SSDEEP

49152:SpW2WCN9mIFOKjQ5Tw2onUr1q7NWcPjH3hCbC5GMhE:SpW2WCDmIFOh5Twkq7NWsXh

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
416	1744	WerFault.exe	84
1860	1744	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 1744	316	rundll32.exe	84
PID 316 wrote to memory of 1744	316	rundll32.exe	84
PID 316 wrote to memory of 1744	316	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6b64f6c0d2cdf795cce4b11cf54d806e8d4a7c7a2cc4b27ba0c9c143fbd9ca3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6b64f6c0d2cdf795cce4b11cf54d806e8d4a7c7a2cc4b27ba0c9c143fbd9ca3.dll,#1
  2⤵
  PID:1744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 624
    3⤵
    - Program crash
    PID:416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 804
    3⤵
    - Program crash
    PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1744 -ip 1744
1⤵
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1744 -ip 1744
1⤵
PID:892