2258d2c455d2241f94f86dd568e6107b54c534bb1f15bc5a84e93e3165230898

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 00:49

Target

1e330860d3faa3763d28c0e59fbb2bd1.dll
Size

88KB
MD5

1e330860d3faa3763d28c0e59fbb2bd1
SHA1

18ecf8dc00176463cbe0a57685695e6728d0ae1b
SHA256

2258d2c455d2241f94f86dd568e6107b54c534bb1f15bc5a84e93e3165230898
SHA512

ec6c9aa347a013887af2e211fc7677c07c05f723eaba0ba18f3192b710dcb8eff089efb89cbc9453df93696537e620abf2bb864efe46af3f19500942025bf6e0
SSDEEP

1536:RPisobWqRuCh3CnKMOqd3KagJZ4X/RGKaNO8oibDJykcyHOK7R:RPisobTh3CKMdd3KagwXJGKaNtvJTum

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3348	3008	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3008	5112	rundll32.exe	89
PID 5112 wrote to memory of 3008	5112	rundll32.exe	89
PID 5112 wrote to memory of 3008	5112	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e330860d3faa3763d28c0e59fbb2bd1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e330860d3faa3763d28c0e59fbb2bd1.dll,#1
  2⤵
  PID:3008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 544
    3⤵
    - Program crash
    PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3008 -ip 3008
1⤵
PID:4068

memory/3008-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download