7dfe6d44b9d931764b56362c4cac2bcb21521b64afc4f93bfd7afa56f1e13872

Analysis

max time kernel
140s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 08:30

Target

5fe77d6be52dc63d5ac67974b1a890cb.dll
Size

4KB
MD5

5fe77d6be52dc63d5ac67974b1a890cb
SHA1

4374cd7a944d1fd1355766d5f904fe49f246a35f
SHA256

7dfe6d44b9d931764b56362c4cac2bcb21521b64afc4f93bfd7afa56f1e13872
SHA512

667e4bc7f8bbcda73a1683786195bde397f0ca77a8a73fe3efed304fe7c620379735189cb65817b5cb2cc0265cde604d42d5c44607b5335668467a887954ea8d
SSDEEP

48:q7mLuoDpJtYt3RTTOZdsdjV9s0XLXYUXLXvrk7c+hpztU/tW:A6G9RTAdQ9FnDo7ccltU/tW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3964	4984	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 4984	3144	rundll32.exe	88
PID 3144 wrote to memory of 4984	3144	rundll32.exe	88
PID 3144 wrote to memory of 4984	3144	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fe77d6be52dc63d5ac67974b1a890cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fe77d6be52dc63d5ac67974b1a890cb.dll,#1
  2⤵
  PID:4984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 612
    3⤵
    - Program crash
    PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4984 -ip 4984
1⤵
PID:3164