6b0731f45ed2ba2456103d2a7c444327b1d4fcee64dee10b36ab5a0543947373

Analysis

max time kernel
146s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 23:07

Target

4239d46d22d7b4c9ab9b29e7f7d27abc.dll
Size

172KB
MD5

4239d46d22d7b4c9ab9b29e7f7d27abc
SHA1

6ebdbfb0f2acee6c1b0b84dc75c391787f78f719
SHA256

6b0731f45ed2ba2456103d2a7c444327b1d4fcee64dee10b36ab5a0543947373
SHA512

67d4ff3a81f5f39891821d8b99f47bda3fd00c691145dbf0d3155988879b90ca0da0c6e3a26f29ae9e193220413e25eb9d18c34230739c4c008e34b08ab75a40
SSDEEP

1536:Mb4uSvl91pVoNby69ni3xGnMXY0xB6JNvWtk2vp8eNOYw54YQL+urgVd7RR1LAf/:U6p2JihGAsJ4tk2+2yW07BLADtxD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4984	1940	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1940	1816	rundll32.exe	88
PID 1816 wrote to memory of 1940	1816	rundll32.exe	88
PID 1816 wrote to memory of 1940	1816	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4239d46d22d7b4c9ab9b29e7f7d27abc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4239d46d22d7b4c9ab9b29e7f7d27abc.dll,#1
  2⤵
  PID:1940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 596
    3⤵
    - Program crash
    PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1940 -ip 1940
1⤵
PID:4852