d74c416bc82c3a7082ab608f955cd332430aa1d2ae95c977496763586e5f22fa

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2023, 08:03

Target

d74c416bc82c3a7082ab608f955cd332430aa1d2ae95c977496763586e5f22fa.dll
Size

2.2MB
MD5

07ae50aa51a1a31419950601e6dab056
SHA1

100915e21263f4baedc462a702ffffed4b414021
SHA256

d74c416bc82c3a7082ab608f955cd332430aa1d2ae95c977496763586e5f22fa
SHA512

3784f0ac700c8ff3a7a54ffceb9682989abc737618b56d5fcee4cb88fa66028dae433e34e6c3df97e95c7da198da6e9af76875f43c2dd9baf4b85585f8922fca
SSDEEP

49152:TJd0CM5Fym/8RgJDYM97tQjFozL19wNa/Wg6:VCCM56yJajFKp9JWg6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4376	4972	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 4972	3136	rundll32.exe	89
PID 3136 wrote to memory of 4972	3136	rundll32.exe	89
PID 3136 wrote to memory of 4972	3136	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d74c416bc82c3a7082ab608f955cd332430aa1d2ae95c977496763586e5f22fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d74c416bc82c3a7082ab608f955cd332430aa1d2ae95c977496763586e5f22fa.dll,#1
  2⤵
  PID:4972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 568
    3⤵
    - Program crash
    PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4972 -ip 4972
1⤵
PID:4448