f01e2f89ea281caa3b0bcdb6a4432156bf546c322621471084c66a32554b3dcb

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 23:40

Target

43de0b0f6c069ee832f7c8dd29edb4af.dll
Size

30KB
MD5

43de0b0f6c069ee832f7c8dd29edb4af
SHA1

457b7505cf30a3de58d066aab7dc18992a87f09f
SHA256

f01e2f89ea281caa3b0bcdb6a4432156bf546c322621471084c66a32554b3dcb
SHA512

13eb25a8ce47ef181088c40bcddb14dc38192d2a0df2ff1f60f632f413223baaa3422d9ea618e33b4e7b7b6d404bd6bd18b3d40b30b34bdd6d2bc63824271e6a
SSDEEP

384:JJ/jyMb3qfiby/rd0ChxHYkfWE8TqX0kZqoA81he5Vfl3Zb40vxMVpjg5vuCaX:T/jyaqabArd0Chx4YUuvZqoA0hIHrG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3120	4292	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 4292	1036	rundll32.exe	15
PID 1036 wrote to memory of 4292	1036	rundll32.exe	15
PID 1036 wrote to memory of 4292	1036	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43de0b0f6c069ee832f7c8dd29edb4af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43de0b0f6c069ee832f7c8dd29edb4af.dll,#1
  2⤵
  PID:4292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 544
    3⤵
    - Program crash
    PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4292 -ip 4292
1⤵
PID:4132

memory/4292-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download