e32401da33702a078b434fc8a3e8270d17c3df6647a4683fe8618cf492d1202e

Analysis

max time kernel
146s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 20:28

Target

10eb82d562a462052b4013e4af8615cf.dll
Size

62KB
MD5

10eb82d562a462052b4013e4af8615cf
SHA1

ada82bb8e3d281019023ab073ae7aea513b46fee
SHA256

e32401da33702a078b434fc8a3e8270d17c3df6647a4683fe8618cf492d1202e
SHA512

f11c4a5e6ca7e6539df76d8061855d9e425f4c6e606555fe2ea0dcd1176cdf179ec48272fe234a9a3bebcc4faee86e77b965b33d85c90b42c45d949c995d7d5c
SSDEEP

768:ZQ/BqAAAdasuMRVhBUphv3bUPHRWaaan3FUr5h6EmNS6:ZeBqAAc/ukBUAGG3F05NmNS6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	1596	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 1596	872	rundll32.exe	89
PID 872 wrote to memory of 1596	872	rundll32.exe	89
PID 872 wrote to memory of 1596	872	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10eb82d562a462052b4013e4af8615cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\10eb82d562a462052b4013e4af8615cf.dll,#1
  2⤵
  PID:1596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 560
    3⤵
    - Program crash
    PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1596 -ip 1596
1⤵
PID:724

memory/1596-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download