119ac1dbd49080932ebfd9cb5c2d563c06d035ea8ae1916fccb43e0db7748940

Analysis

max time kernel
139s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 18:50

Target

35bbe6308cf831bb3a4f04ca0165b94c.dll
Size

3.1MB
MD5

35bbe6308cf831bb3a4f04ca0165b94c
SHA1

33d703964f9070049491299e60b6d91bd32d7727
SHA256

119ac1dbd49080932ebfd9cb5c2d563c06d035ea8ae1916fccb43e0db7748940
SHA512

594d24f1a5b4b9e89394cf101e5ed7c1b3cd1ae43fd786ec90d113511a0d234f0aa464cb5559ece9613ee19644de7fd6b32717027f2b06b4eef2b6376f05e1c9
SSDEEP

49152:55np3PSRTxd1R7h017xvE0cfNqHrHEiei6TMPnmV:55nk1M7xvE0c1+HEi

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1432	4988	WerFault.exe	88
2424	4988	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 4988	3840	rundll32.exe	88
PID 3840 wrote to memory of 4988	3840	rundll32.exe	88
PID 3840 wrote to memory of 4988	3840	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35bbe6308cf831bb3a4f04ca0165b94c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35bbe6308cf831bb3a4f04ca0165b94c.dll,#1
  2⤵
  PID:4988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 740
    3⤵
    - Program crash
    PID:1432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 664
    3⤵
    - Program crash
    PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4988 -ip 4988
1⤵
PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4988 -ip 4988
1⤵
PID:1872

memory/4988-0-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/4988-1-0x00000000014C0000-0x00000000014C1000-memory.dmp

Filesize
4KB

Download
memory/4988-3-0x0000000000400000-0x000000000071F000-memory.dmp

Filesize
3.1MB

Download
memory/4988-5-0x00000000014C0000-0x00000000014C1000-memory.dmp

Filesize
4KB

Download