115ed1c8347b13bfd38a59786b17c1840dfd61bb30a1c2ce0dc95b22d4c085e4

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 20:02

Target
115ed1c8347b13bfd38a59786b17c1840dfd61bb30a1c2ce0dc95b22d4c085e4.dll
Size 2.2MB
Sample231222-ysgzvadcdl
SHA256 115ed1c8347b13bfd38a59786b17c1840dfd61bb30a1c2ce0dc95b22d4c085e4
MD5 d5c9b09332b84e4dd21e5e54d92fc4bd
SHA1 8fa690181ae91f066f729550a7a0ec4827cdff9e
SHA512 b8327734785f1818daa55c3abdc457104ae53a3d1d2d1a58fe8809d30da0ed5258314c3f180a66c779d661c353533a9867a04c1b05b6e5a21b35b7fbb7a6e21c
SSDEEP 49152:TJd0/M5Fym/8RgJCYM97tQjFozL19wNa/Wgs:VC/M56yJHjFKp9JWgs
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4824	1088	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 1088	3912	rundll32.exe	14
PID 3912 wrote to memory of 1088	3912	rundll32.exe	14
PID 3912 wrote to memory of 1088	3912	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\115ed1c8347b13bfd38a59786b17c1840dfd61bb30a1c2ce0dc95b22d4c085e4.dll,#1
1⤵
PID:1088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 572
  2⤵
  - Program crash
  PID:4824

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\115ed1c8347b13bfd38a59786b17c1840dfd61bb30a1c2ce0dc95b22d4c085e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1088 -ip 1088
1⤵
PID:3708