cb6a774293d7bb629df4618330357d107a00b12e24c7ae20df359c45373310dd

Analysis

max time kernel
147s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 20:42

Target

3c1515fe1f52a61f4bbea983508e1b48.dll
Size

178KB
MD5

3c1515fe1f52a61f4bbea983508e1b48
SHA1

df02bcdd1fb3f2f99b6165423e82038e603160d5
SHA256

cb6a774293d7bb629df4618330357d107a00b12e24c7ae20df359c45373310dd
SHA512

60219422664da4e546725dba4ba2163e5dc846c2c31f7e4389449692e3ce2124c08b519ef171be859c596863682b7b588df6fa3483e9dd31b2d3717f1b170bc1
SSDEEP

3072:TG4jo4/UVsWbKl5xG8/gaKMaQpUu03cM/wQU0DkAq8uwCj:5oGl5xXIaKYU3c4w4k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1140	3544	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3544	640	rundll32.exe	14
PID 640 wrote to memory of 3544	640	rundll32.exe	14
PID 640 wrote to memory of 3544	640	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c1515fe1f52a61f4bbea983508e1b48.dll,#1
1⤵
PID:3544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 552
  2⤵
  - Program crash
  PID:1140

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c1515fe1f52a61f4bbea983508e1b48.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3544 -ip 3544
1⤵
PID:1244