8ac447bb7b869b82bfb6a284aac2321ac9d8f12887dc9527f1603f2ef1b07f7a

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 05:59

Target

09e1702bd3a3943df6558b59697189a4.dll
Size

171KB
MD5

09e1702bd3a3943df6558b59697189a4
SHA1

e904fb6a490977ee570edd9d90c641485c2d9d02
SHA256

8ac447bb7b869b82bfb6a284aac2321ac9d8f12887dc9527f1603f2ef1b07f7a
SHA512

c833b1f44194cf82f5f7d755a059c5f9df735d9a212e3d7cd93fd60d09a9934eb4150378f45f493f281068659c4768ac60c9325177d728aa08d244dfb847b334
SSDEEP

3072:p8/NbdCGRtFq1zkuPczNslVnv70dWg6YIKOGBgmMMmq0yiF5y:p8VlRK1Aal5KWg6+BgmMVFT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	2328	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2328	2924	rundll32.exe	89
PID 2924 wrote to memory of 2328	2924	rundll32.exe	89
PID 2924 wrote to memory of 2328	2924	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09e1702bd3a3943df6558b59697189a4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09e1702bd3a3943df6558b59697189a4.dll,#1
  2⤵
  PID:2328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 564
    3⤵
    - Program crash
    PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2328 -ip 2328
1⤵
PID:1028

memory/2328-0-0x0000000000D80000-0x0000000000D99000-memory.dmp

Filesize
100KB

Download