16dc54abc6a05f145ecc12884c67286fd8e925c990907ee42cb962a1466bb9b8

Analysis

max time kernel
140s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 12:50

Target

1fd0b996dcdc4124c62254797c689a00.dll
Size

94KB
MD5

1fd0b996dcdc4124c62254797c689a00
SHA1

8c65bb21744b35514991585da39c07a37fef386f
SHA256

16dc54abc6a05f145ecc12884c67286fd8e925c990907ee42cb962a1466bb9b8
SHA512

bb27cf2460aedef82b6a2b2adfdaed7540ebdefeef4df645a92d3720b40226c70c14d7c57357d35683ee9e21cd91ce5d9ae41c477daec492c76d0e7a1fcac040
SSDEEP

1536:HJiW35/pvcvn2vO7KjUQfTMfnJdkNKgCWQSonKhA68x2WFM4OiCCswRvK:t5/Ncvn2meIQfTMfnHkN9QHHn52tD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3904	1564	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 1564	1868	rundll32.exe	14
PID 1868 wrote to memory of 1564	1868	rundll32.exe	14
PID 1868 wrote to memory of 1564	1868	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fd0b996dcdc4124c62254797c689a00.dll,#1
1⤵
PID:1564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 540
  2⤵
  - Program crash
  PID:3904

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fd0b996dcdc4124c62254797c689a00.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1564 -ip 1564
1⤵
PID:2336

memory/1564-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download