23f5c0a3cb61a613aaef3c61bf33aba7c51143c5b0e5646008bfd33a42a375da

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 13:54

Target

2369855a4f4aa0063855fb646d84ee13.dll
Size

128KB
MD5

2369855a4f4aa0063855fb646d84ee13
SHA1

4226253706f5899e09f64178cb9cbcfda596edb4
SHA256

23f5c0a3cb61a613aaef3c61bf33aba7c51143c5b0e5646008bfd33a42a375da
SHA512

a0d7a30bef42dcd2da686741b2def8d77fdfd20e75d4af232b019c4a96bd3d7985c947d683facb2c9711a11ae4ba75a864c6decab250768ffad137a5e6acba46
SSDEEP

3072:osJktXqkaAp78heywCtFUulfa0hobNVpIrE3rH/4oOobv:UtXqkaa4hzwyibZI4rHpv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4924	4796	WerFault.exe	32

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 4796	3008	rundll32.exe	32
PID 3008 wrote to memory of 4796	3008	rundll32.exe	32
PID 3008 wrote to memory of 4796	3008	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2369855a4f4aa0063855fb646d84ee13.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2369855a4f4aa0063855fb646d84ee13.dll,#1
  2⤵
  PID:4796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 600
    3⤵
    - Program crash
    PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4796 -ip 4796
1⤵
PID:4372

memory/4796-0-0x000000006D0C0000-0x000000006D0E0000-memory.dmp

Filesize
128KB

Download