8cbd9ad03fd291768414ea376c03787012c426edda2501f1f731eba6a317e930

Analysis

max time kernel
144s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 18:57

Target

36266b87dea28409dbcb2ae92e3f5fb2.dll
Size

2.7MB
MD5

36266b87dea28409dbcb2ae92e3f5fb2
SHA1

8eeb3e39eba72f6b2e294c03e4b92134e49040b6
SHA256

8cbd9ad03fd291768414ea376c03787012c426edda2501f1f731eba6a317e930
SHA512

da98565c9e83066694e533f67d23b28f0632b02e21bad554db78062e76e00405f1ab93a49d293955ca9f725e34b5347352ca772997ded67f6dbd068c9e097e83
SSDEEP

49152:xV9Y+y9Y+K9Y+w9Y+y9Y+c9Y+y9Y+m9Y+O9Y+K9Y+q9Y+O9Y+W9Y+69Y+29Y+M9T:D1y1K1w1y1c1y1m1O1K1q1O1W16121Mh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4900	3976	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 3976	816	rundll32.exe	88
PID 816 wrote to memory of 3976	816	rundll32.exe	88
PID 816 wrote to memory of 3976	816	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\36266b87dea28409dbcb2ae92e3f5fb2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\36266b87dea28409dbcb2ae92e3f5fb2.dll,#1
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 616
    3⤵
    - Program crash
    PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3976 -ip 3976
1⤵
PID:2396