e365c3c99bb4c8a0b0a20128dcab51f9ca11ac0c150f01616c25ca2daf5e35c9

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 05:34

Target

08580ce32c008de8e7bf915dc498d852.dll
Size

42KB
MD5

08580ce32c008de8e7bf915dc498d852
SHA1

aa628ab022f5fedd595cfff8e97a5abc16c71143
SHA256

e365c3c99bb4c8a0b0a20128dcab51f9ca11ac0c150f01616c25ca2daf5e35c9
SHA512

2479128683c6ff0ff429e6be16ad8d8a9edd017cc2e5c882ed35980c9d432e461311189ec6d0811f4a62ff0ec8dd4ff89024c924861e8938dd62252094d30776
SSDEEP

768:6veFSj6XrWKczRgXBVOY/rWPEVMBM/IHmlEoqUUkZY7gJGAdUX:PU6X9czkI4rWP+9luUUVfX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2476	2464	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2464	2612	rundll32.exe	87
PID 2612 wrote to memory of 2464	2612	rundll32.exe	87
PID 2612 wrote to memory of 2464	2612	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08580ce32c008de8e7bf915dc498d852.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\08580ce32c008de8e7bf915dc498d852.dll,#1
  2⤵
  PID:2464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 592
    3⤵
    - Program crash
    PID:2476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2464 -ip 2464
1⤵
PID:2084

memory/2464-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download