719aecf90bd0b4724543bf28da6a9410dd1228bbb2b8068ba27753e927905db9

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 09:04

Target

13c1d3533d75eaa04242171fa3c255c2.dll
Size

208KB
MD5

13c1d3533d75eaa04242171fa3c255c2
SHA1

e15a2883083a169848fae88c584c7a434c8cd836
SHA256

719aecf90bd0b4724543bf28da6a9410dd1228bbb2b8068ba27753e927905db9
SHA512

cdaad269938ddee3e171b6249dcaa8bfb2c0b6a2e20d458a6bc58aff5eba37228bd05b16a3b599d52cc5e0165669af22072f7eb0786ee87fd44fe9da3908d9bc
SSDEEP

3072:gn1hG1MrkCkyD/VJcFyaupo2yw/awYwBlUHFtwFPM:VKj/wnRwSYUYFk

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4612	5072	WerFault.exe	87
1280	5072	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 5072	3308	rundll32.exe	87
PID 3308 wrote to memory of 5072	3308	rundll32.exe	87
PID 3308 wrote to memory of 5072	3308	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13c1d3533d75eaa04242171fa3c255c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13c1d3533d75eaa04242171fa3c255c2.dll,#1
  2⤵
  PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 592
    3⤵
    - Program crash
    PID:4612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 864
    3⤵
    - Program crash
    PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5072 -ip 5072
1⤵
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5072 -ip 5072
1⤵
PID:3624