37e408fc7b5af20933e0e96cbd95a91683f0a77c1c243c2ad9371849c4bef871

Analysis

max time kernel
155s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 11:39

Target

6b7e882747c51de8ad4fe0fd4b5fe51a.dll
Size

20KB
MD5

6b7e882747c51de8ad4fe0fd4b5fe51a
SHA1

d4111d62db8909fb3b156ddaf2166d15d541abeb
SHA256

37e408fc7b5af20933e0e96cbd95a91683f0a77c1c243c2ad9371849c4bef871
SHA512

6f17335864ffe6fd205028153d307e0688bf8c4948efdfe05fbc2d2422c8e3965991dff4c739763fe5b9d38ee50ca6de3a66089634584ff05e40404c078f073d
SSDEEP

384:zSG/2Jp+C6QhtmruxCcdIL+0XplcBCAu8UaWHuqaTlX0wG:zfYh2oCtpXPcBx2OqaewG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4724	4708	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4708	4872	rundll32.exe	89
PID 4872 wrote to memory of 4708	4872	rundll32.exe	89
PID 4872 wrote to memory of 4708	4872	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b7e882747c51de8ad4fe0fd4b5fe51a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6b7e882747c51de8ad4fe0fd4b5fe51a.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 624
    3⤵
    - Program crash
    PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4708 -ip 4708
1⤵
PID:2364

memory/4708-0-0x000000006F840000-0x000000006F84C000-memory.dmp

Filesize
48KB

Download