cb6919c53d3d1605b33d6e3c581b2ed209f316c5cbcb43e6436105b7fe7a00eb

Analysis

max time kernel
147s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 15:36

Target

29c6062ea8dc25361a9f418f48050abd.dll
Size

291KB
MD5

29c6062ea8dc25361a9f418f48050abd
SHA1

693177ee95fb6468acd563ed46d300c401aeedd4
SHA256

cb6919c53d3d1605b33d6e3c581b2ed209f316c5cbcb43e6436105b7fe7a00eb
SHA512

c3a8898a695ab94b19e071109cba6013b992be33e9d3ef8bb33a094abbb26c44e5e584b4202062cba2d340c6008e7082f16b8663b6ab10c70609f30a9a66f6c7
SSDEEP

6144:GA1wTB+aXRAiNsZDXdBqEc4gga0NeYhNuOncD6v5xIQrS31:ql+aBANZDXdBm4VakuOcD6hxIR3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1412	2180	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 2180	4696	rundll32.exe	14
PID 4696 wrote to memory of 2180	4696	rundll32.exe	14
PID 4696 wrote to memory of 2180	4696	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29c6062ea8dc25361a9f418f48050abd.dll,#1
1⤵
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 580
  2⤵
  - Program crash
  PID:1412

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29c6062ea8dc25361a9f418f48050abd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2180 -ip 2180
1⤵
PID:4580