3a3131b7e3cf6bc80a6af4331e543fe57b890716018b1b1addb7bf8d2de4f815

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 15:35

Target

da787c9ee3059b56650c2b9801cd77a9.dll
Size

2.0MB
MD5

da787c9ee3059b56650c2b9801cd77a9
SHA1

b3e390f794c30f192476e43c371f7eb544f0d214
SHA256

3a3131b7e3cf6bc80a6af4331e543fe57b890716018b1b1addb7bf8d2de4f815
SHA512

c5c85cb788d52f3c78beb9cf584e3683dd9a47649323e569dbcf2f7ba332170a7244c60778758df7800941f74b62f3a8db4a26824c87c4c5167bd48cfdfb67da
SSDEEP

24576:dmFyjLF847eiWWcoGZVOIxh/WxIAIbG+JJJJmmFyjLF847eiWWcoGZVOIxh/WxIy:t+ZVX+xIPbdJJJJK+ZVX+xIPb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2276	2440	WerFault.exe	55

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2440	2320	rundll32.exe	55
PID 2320 wrote to memory of 2440	2320	rundll32.exe	55
PID 2320 wrote to memory of 2440	2320	rundll32.exe	55

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da787c9ee3059b56650c2b9801cd77a9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da787c9ee3059b56650c2b9801cd77a9.dll,#1
  2⤵
  PID:2440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 600
    3⤵
    - Program crash
    PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2440 -ip 2440
1⤵
PID:2956