07647de946e0909e0b6562099025cede81e82c8fc76fa5bce236460a97fe4a95

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 08:27

Target

5fc434b58b2d632f40735b32e7fb73fd.dll
Size

100KB
MD5

5fc434b58b2d632f40735b32e7fb73fd
SHA1

8dcf75973f71136b258d259f353f774e52f65f18
SHA256

07647de946e0909e0b6562099025cede81e82c8fc76fa5bce236460a97fe4a95
SHA512

226d376ef694506e4043d0317fceae12ba239de3bac8d58a8b0841e3f7999eb88308578bf6837cc49383d0bfad7b74af893f22cbe826ca4ff38b47874c9340de
SSDEEP

1536:9qIpyl1c5LDigJiceMj6mNAHrj196MOQQmCk3JNzCzZGWMYQTApLaOtJnYds+FlX:4IpqulbaMj6mNu3QmCUJNzCzbeAJn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4908	4836	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 4836	540	rundll32.exe	14
PID 540 wrote to memory of 4836	540	rundll32.exe	14
PID 540 wrote to memory of 4836	540	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fc434b58b2d632f40735b32e7fb73fd.dll,#1
1⤵
PID:4836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 560
  2⤵
  - Program crash
  PID:4908

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fc434b58b2d632f40735b32e7fb73fd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4836 -ip 4836
1⤵
PID:4976

memory/4836-0-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download