df3c767196fdb051d680984a1adb72e5a2be22e4a15e4e58c5e185cb1a0fe805

Analysis

max time kernel
111s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 12:52

Target

90347edc331c93889aae7e6ebe234a34.dll
Size

25KB
MD5

90347edc331c93889aae7e6ebe234a34
SHA1

32e533099668109b1b7fd376400a748fd68097a0
SHA256

df3c767196fdb051d680984a1adb72e5a2be22e4a15e4e58c5e185cb1a0fe805
SHA512

489658c0886bda4e24ead103bd7f76629379ff11a869e07f3f41c96502a6f8dfc7884ff41dc250f1730e405c53da7c427211bf36a5f7897241f52335785f9241
SSDEEP

192:5CrDTYEQuAXiz74r88LdyyiNikOthFHdpKpFzqZz/D1D6qtasngC6kt8w8ck8Gns:c4iz7wbyy0bGhFHdgTQv1Twkt8dcRv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3996	2064	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 2064	4272	rundll32.exe	14
PID 4272 wrote to memory of 2064	4272	rundll32.exe	14
PID 4272 wrote to memory of 2064	4272	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90347edc331c93889aae7e6ebe234a34.dll,#1
1⤵
PID:2064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 600
  2⤵
  - Program crash
  PID:3996

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90347edc331c93889aae7e6ebe234a34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2064 -ip 2064
1⤵
PID:1308