32cfb555f19fd90d2c92fd89453d16388b18f2808dcb21186e4375d49c8b0620

Analysis

max time kernel
132s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2023, 10:30

Target

0696e1297cfd2bb2d72c9180855457fa.dll
Size

104KB
MD5

0696e1297cfd2bb2d72c9180855457fa
SHA1

73b54438f86c88aa559702cf52f92d68196f172f
SHA256

32cfb555f19fd90d2c92fd89453d16388b18f2808dcb21186e4375d49c8b0620
SHA512

8517373d9ea2ff91af4a9d2117abfa66987a0f086b97c643f3785f4d522d0ddc8512fed2667c1131fa6366edb6b534f73a055126c5634b3d90269af58d71ba5a
SSDEEP

1536:6WGfGAXqrlOjRsu0R7mfJdYCD0EczMY3cFJeg0Hv75jcTZr03Wklk9ncobUfs/Ga:DGfGAilO2InDYE2JaAxlkrjGP8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4688	4900	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 4900	840	rundll32.exe	87
PID 840 wrote to memory of 4900	840	rundll32.exe	87
PID 840 wrote to memory of 4900	840	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0696e1297cfd2bb2d72c9180855457fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0696e1297cfd2bb2d72c9180855457fa.dll,#1
  2⤵
  PID:4900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 624
    3⤵
    - Program crash
    PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4900 -ip 4900
1⤵
PID:3316