621b48c9eca54215b7f1c2fa9f7acf9441764dcaf23bcd63ade8b5776708ce69

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 00:40

Target

471817407004da2e1ed0b168259214a3.dll
Size

318KB
MD5

471817407004da2e1ed0b168259214a3
SHA1

3d266fd9e6b23b76e71c0c94fcc7e838a26446e4
SHA256

621b48c9eca54215b7f1c2fa9f7acf9441764dcaf23bcd63ade8b5776708ce69
SHA512

d9cc8ee7a513825febdb061871ac6b441c0fe5b180d0b13cc79030099e6a517166d3e9fd873f9d54d0b04b5e391ad440ecc92b74aae9cb10c33431f14f9aae04
SSDEEP

6144:VK5UYknlygj/lfGnjoppQeeaQeerFQeesQeecmQeehQee4bAvVNKtlMPsuX:VK5UYkldblgo+ACXO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4108	1704	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 1704	4316	rundll32.exe	14
PID 4316 wrote to memory of 1704	4316	rundll32.exe	14
PID 4316 wrote to memory of 1704	4316	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\471817407004da2e1ed0b168259214a3.dll,#1
1⤵
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 728
  2⤵
  - Program crash
  PID:4108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\471817407004da2e1ed0b168259214a3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1704 -ip 1704
1⤵
PID:3648

memory/1704-0-0x0000000075480000-0x00000000754D5000-memory.dmp

Filesize
340KB

Download
memory/1704-1-0x0000000075480000-0x00000000754D5000-memory.dmp

Filesize
340KB

Download