75f3314ce19262f1846345189b196e1440cfcafd6a0505b608cbeeb2cd4198ae

Analysis

max time kernel
149s
max time network
83s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 17:28

Target

0889392a5b295bf8f071a843a34f439e.dll
Size

32KB
MD5

0889392a5b295bf8f071a843a34f439e
SHA1

cf914557e289a8bd82672df67c7598ff3a575d4b
SHA256

75f3314ce19262f1846345189b196e1440cfcafd6a0505b608cbeeb2cd4198ae
SHA512

9bc68aab316b0cf2f5c759d99cd9499e611753a1a560d47525eca53e989f69e0fb0801071856b96d7d9aac8b9c02d3d36da5243f1699dc080ef5521060babd68
SSDEEP

384:K63mPFLEf1szTYe+jOWJmlaOvDUXXYtyzx4W+LQgNoUofnv:z8Fk1uTYxwUX+44tLjiUof

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3468	5044	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 5044	3332	rundll32.exe	14
PID 3332 wrote to memory of 5044	3332	rundll32.exe	14
PID 3332 wrote to memory of 5044	3332	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0889392a5b295bf8f071a843a34f439e.dll,#1
1⤵
PID:5044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 560
  2⤵
  - Program crash
  PID:3468

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0889392a5b295bf8f071a843a34f439e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5044 -ip 5044
1⤵
PID:1472

memory/5044-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download