27ddbb4da308073f18d8945f389a19d4d85a6ab02a50dbf68e8dd33297e62a40

Analysis

max time kernel
193s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 16:06

Target

2bc2f576b40945ec77aeb7015d2b89ab.dll
Size

745KB
MD5

2bc2f576b40945ec77aeb7015d2b89ab
SHA1

00c3beb029cccb59dab8b1527599af5b1ec8e12a
SHA256

27ddbb4da308073f18d8945f389a19d4d85a6ab02a50dbf68e8dd33297e62a40
SHA512

38b4c91223c185efc10371bb2d44d1882d12b696d669e256f60bd85881d5acf28704f5cbe402344ebc9478375c19e70b7eaca622cc45b88208e96ffd3792d5ae
SSDEEP

12288:L2PiYoyrcK4tMrWdH0u9VkEItiWPj0GgPALBnGWTwVvRl7:L29N4pbwEIEWPYHPcBnBTwV77

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5084	1004	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1004	1424	rundll32.exe	88
PID 1424 wrote to memory of 1004	1424	rundll32.exe	88
PID 1424 wrote to memory of 1004	1424	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bc2f576b40945ec77aeb7015d2b89ab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bc2f576b40945ec77aeb7015d2b89ab.dll,#1
  2⤵
  PID:1004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 540
    3⤵
    - Program crash
    PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1004 -ip 1004
1⤵
PID:3008