5686c2f009965e751062679bb038b55991bf1cab1bfd2772d90ca9e91e54617d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 08:13

Target

114a50d49f449271807124803d476ee0.dll
Size

211KB
MD5

114a50d49f449271807124803d476ee0
SHA1

df242aacb4fd297cd53ceb4f9f7a9c52ba1423b5
SHA256

5686c2f009965e751062679bb038b55991bf1cab1bfd2772d90ca9e91e54617d
SHA512

ebd309b6cf39a12d465158fbe0a4f68624f2d1766df62490bc7967ef757bea0ac5b7633a02c9cf468f2c8be48c1e5c7d347149c7730d97dd88222b07bfdff7f5
SSDEEP

6144:SubhHset/tA0txMjSHCgw69/hJo90AC1JKclF:Bdt/tjxaSG6phJW0rScl

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1268	3916	WerFault.exe	59
4004	3916	WerFault.exe	59

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 3916	4076	rundll32.exe	59
PID 4076 wrote to memory of 3916	4076	rundll32.exe	59
PID 4076 wrote to memory of 3916	4076	rundll32.exe	59

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\114a50d49f449271807124803d476ee0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\114a50d49f449271807124803d476ee0.dll,#1
  2⤵
  PID:3916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 560
    3⤵
    - Program crash
    PID:1268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 796
    3⤵
    - Program crash
    PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3916 -ip 3916
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3916 -ip 3916
1⤵
PID:4356