5f3a2a03f5da48e43e2f51df57394fb698f910736e52a5101077ada69032b2a0

Analysis

max time kernel
146s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 17:29

Target

0890777c65b48547214eade7286dec1b.dll
Size

15KB
MD5

0890777c65b48547214eade7286dec1b
SHA1

47df73def3cbcd946bd566bba54ee32aeacba628
SHA256

5f3a2a03f5da48e43e2f51df57394fb698f910736e52a5101077ada69032b2a0
SHA512

076c4873f95cc56a0d61c7d3847eb7fb198c005496119cd11e46159a7788eb17a2752ad1796c19684a9f833557b3f30a8657bcf6fe2d0883b4caed1c3611869a
SSDEEP

192:neHUhqmx8zsL2YtqfmDK1ws2w2miQvSfBE2SspLU+NdE09FXJdKfmZ:eHUhq5M2MqQTQ6fBE2SGrrE09FX1Z

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
548	2112	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 2112	3660	rundll32.exe	14
PID 3660 wrote to memory of 2112	3660	rundll32.exe	14
PID 3660 wrote to memory of 2112	3660	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0890777c65b48547214eade7286dec1b.dll,#1
1⤵
PID:2112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 564
  2⤵
  - Program crash
  PID:548

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0890777c65b48547214eade7286dec1b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2112 -ip 2112
1⤵
PID:2984