3b5105df649bbf460b458bb1ffec617e9bdf4a3e48fbd81aaf27572805a4c1e1

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 01:11

Target

483b4b6e25389271d458815580ade3a8.dll
Size

116KB
MD5

483b4b6e25389271d458815580ade3a8
SHA1

79c3e398f14f40e3bddc64ace31fb6c4f445ec33
SHA256

3b5105df649bbf460b458bb1ffec617e9bdf4a3e48fbd81aaf27572805a4c1e1
SHA512

ec22ffad51a549b81317adc40edf1015faab576865564b3c824a16c58e8fbf7a6f90dc92de63224b0d4929390713e9da0624abf34e93d6c9d3a0b9f4e89dd3ad
SSDEEP

1536:S/TvNHwbrgo2xKAOW4B7vzSa3dZEjr1PfOew7Z1TjK/jJnCFf6IE6+rCrv:KNHwb0j2Pl3X4RfU1TaOf6b8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1520	212	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 212	2564	rundll32.exe	16
PID 2564 wrote to memory of 212	2564	rundll32.exe	16
PID 2564 wrote to memory of 212	2564	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\483b4b6e25389271d458815580ade3a8.dll,#1
1⤵
PID:212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 552
  2⤵
  - Program crash
  PID:1520

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\483b4b6e25389271d458815580ade3a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 212 -ip 212
1⤵
PID:4700

memory/212-0-0x0000000010000000-0x000000001008F000-memory.dmp

Filesize
572KB

Download