5f1aa4e7f1f3f251973597757bc99488e1ff2f88405e76d0f6ebb907c1ea4bbc

Analysis

max time kernel
155s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 21:13

Target

3cfae4f15cd7fb9891056ea5621f432f.dll
Size

77KB
MD5

3cfae4f15cd7fb9891056ea5621f432f
SHA1

5f87b8ed26d6408faa00bb927e0819ba55d97d06
SHA256

5f1aa4e7f1f3f251973597757bc99488e1ff2f88405e76d0f6ebb907c1ea4bbc
SHA512

faed8515dfd18e0e6a2b382e397ebce41f24edb4df97b3240ed14f6c2a9bd030738b2ce67c93c8a8a3edf278d2c0b49c1dcd0d31628a372a09e86766f12e22ec
SSDEEP

1536:v/zg7GHMc55X9RR4iMDBnElLX1i0r0lhfvzts/vfg2wbmnkKAtEDeF8vY/Vy:v0KHt55X9RUwLli0mRvGo+nkKALF8Ac

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3708	4268	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 4268	404	rundll32.exe	16
PID 404 wrote to memory of 4268	404	rundll32.exe	16
PID 404 wrote to memory of 4268	404	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cfae4f15cd7fb9891056ea5621f432f.dll,#1
1⤵
PID:4268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 596
  2⤵
  - Program crash
  PID:3708

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3cfae4f15cd7fb9891056ea5621f432f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4268 -ip 4268
1⤵
PID:5056

memory/4268-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download