994df1511b1b259fb9f95c7aee6dd519e5a0b5c1a3b66d1345e60f8ee5af445f

Analysis

max time kernel
122s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 20:11

Target

100ab1c4754858ba7b6cbcdfb2932540.dll
Size

77KB
MD5

100ab1c4754858ba7b6cbcdfb2932540
SHA1

1673e9b470adefd542760d90cf28d7c5e213d6b3
SHA256

994df1511b1b259fb9f95c7aee6dd519e5a0b5c1a3b66d1345e60f8ee5af445f
SHA512

7254684372a123a1d0bfc33e590134dc40cea0d9d998c030b7d20d257dc00f85e8df09dd027ec874c512ff9a80ec66ad8515321d0dae6bb4be2c29e52f44ff7a
SSDEEP

1536:Ql4Ol0PGc4R8Pv4Dw1yUpbQFnToIfxgY0r5ZmNiTJbhN9:Forc4RA8w1yUpbQtTBfxgY0r5ZmNiTJR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1144	1804	WerFault.exe	21

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 1804	2056	rundll32.exe	21
PID 2056 wrote to memory of 1804	2056	rundll32.exe	21
PID 2056 wrote to memory of 1804	2056	rundll32.exe	21

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\100ab1c4754858ba7b6cbcdfb2932540.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\100ab1c4754858ba7b6cbcdfb2932540.dll,#1
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 644
    3⤵
    - Program crash
    PID:1144

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k krnlsrvc
1⤵
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1804 -ip 1804
1⤵
PID:1572