35e3ef39660910b3531cdf14bb71d304db5660e862860e47c8eebbbcbd9c360f

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 05:10

Target

06f2613a2c57b362ed09147a1e5e6ac3.dll
Size

81KB
MD5

06f2613a2c57b362ed09147a1e5e6ac3
SHA1

91f080061f07d6f30967b04e78def69f278d18dc
SHA256

35e3ef39660910b3531cdf14bb71d304db5660e862860e47c8eebbbcbd9c360f
SHA512

9f38215850b4d38d7caa2e1008f793d34ba72c34473a54ab7fe291ac5eb23ececb3b929b4ef0a62e28dd01328139a982ed37ca806ca72d8620ae83293415d997
SSDEEP

1536:g5NzcUGQQvLt9yydgHLdNYJDIdI42glFu4MEramH+Fjqpveq+:CNdQTt0KGL3YJDw/L/NEqpGq+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1780	1200	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 1200	3616	rundll32.exe	15
PID 3616 wrote to memory of 1200	3616	rundll32.exe	15
PID 3616 wrote to memory of 1200	3616	rundll32.exe	15

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06f2613a2c57b362ed09147a1e5e6ac3.dll,#1
1⤵
PID:1200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 556
  2⤵
  - Program crash
  PID:1780

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06f2613a2c57b362ed09147a1e5e6ac3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1200 -ip 1200
1⤵
PID:1820

memory/1200-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download