e55cfc78061e2146bb0b9a327acc8f9cf69a9f80534e9c8987381f11536cd5a3

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 16:31

Target

2d5b914b06a03312e98ae30c3a5e9bb0.dll
Size

129KB
MD5

2d5b914b06a03312e98ae30c3a5e9bb0
SHA1

448226211e9e7053805cc26e65f37dd3f664485e
SHA256

e55cfc78061e2146bb0b9a327acc8f9cf69a9f80534e9c8987381f11536cd5a3
SHA512

80d57321f2679fdd898e886f290c9de6acb3a2d8de734301318e0cb1593310ec0bb8874013e1146c32bfc37d254a07ad82b18cf10abcddfc4a861eddf0a26331
SSDEEP

3072:ypnfIFc1oJV/t6IIGRTH/ZOpDy3FSgfS3OL5PFn0wcccccccc:yhQFkIIGdcpDy1SgfS30PFn0wccccccz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2404	1588	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 1588	4052	rundll32.exe	14
PID 4052 wrote to memory of 1588	4052	rundll32.exe	14
PID 4052 wrote to memory of 1588	4052	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d5b914b06a03312e98ae30c3a5e9bb0.dll,#1
1⤵
PID:1588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 552
  2⤵
  - Program crash
  PID:2404

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d5b914b06a03312e98ae30c3a5e9bb0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1588 -ip 1588
1⤵
PID:224