115ed1c8347b13bfd38a59786b17c1840dfd61bb30a1c2ce0dc95b22d4c085e4

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 20:02

Target

115ed1c8347b13bfd38a59786b17c1840dfd61bb30a1c2ce0dc95b22d4c085e4.dll
Size

2.2MB
MD5

d5c9b09332b84e4dd21e5e54d92fc4bd
SHA1

8fa690181ae91f066f729550a7a0ec4827cdff9e
SHA256

115ed1c8347b13bfd38a59786b17c1840dfd61bb30a1c2ce0dc95b22d4c085e4
SHA512

b8327734785f1818daa55c3abdc457104ae53a3d1d2d1a58fe8809d30da0ed5258314c3f180a66c779d661c353533a9867a04c1b05b6e5a21b35b7fbb7a6e21c
SSDEEP

49152:TJd0/M5Fym/8RgJCYM97tQjFozL19wNa/Wgs:VC/M56yJHjFKp9JWgs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4824	1088	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 1088	3912	rundll32.exe	14
PID 3912 wrote to memory of 1088	3912	rundll32.exe	14
PID 3912 wrote to memory of 1088	3912	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\115ed1c8347b13bfd38a59786b17c1840dfd61bb30a1c2ce0dc95b22d4c085e4.dll,#1
1⤵
PID:1088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 572
  2⤵
  - Program crash
  PID:4824

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\115ed1c8347b13bfd38a59786b17c1840dfd61bb30a1c2ce0dc95b22d4c085e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1088 -ip 1088
1⤵
PID:3708