dde42ca4a4b5700d6a368b2e3f6c903717934da41ba151892f9dfb0f5ce65361

Analysis

max time kernel
149s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 07:36

Target
0f4608c24f3d16921b8746ec41900b47.dll
Size 83KB
Sample231225-jfdz4aedb5
SHA256 dde42ca4a4b5700d6a368b2e3f6c903717934da41ba151892f9dfb0f5ce65361
MD5 0f4608c24f3d16921b8746ec41900b47
SHA1 3eed0187ef12411d9bb4eaf9128e3300d5f6e65f
SHA512 69c457bf87f541ffcc25852d339ba419c8f451c79acab0978dadd48fa5c12179acd408d2f80696b94a0323b3c79552061a2d2945b1bfc88bee8177af1c98c23d
SSDEEP 1536:mHZJYpMZawl7MGjhgLyZFOhVHtxQDDT25js/5oku8lfbaPiW:m8GZ3wUgmZFOXIDX4js/5oD8l2q
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	3936	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 3936	5008	rundll32.exe	14
PID 5008 wrote to memory of 3936	5008	rundll32.exe	14
PID 5008 wrote to memory of 3936	5008	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f4608c24f3d16921b8746ec41900b47.dll,#1
1⤵
PID:3936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 624
  2⤵
  - Program crash
  PID:1992

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f4608c24f3d16921b8746ec41900b47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3936 -ip 3936
1⤵
PID:3572

memory/3936-0-0x0000000010000000-0x0000000010028000-memory.dmp

Download

memory/3936-1-0x0000000010000000-0x0000000010028000-memory.dmp

Download