7de7f3ce2c1c10339d2ab756f29c346159e47bd70ac13c8f1cc747bf8fd69362

Analysis

max time kernel
134s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 13:03

Target

70af0cf0f433dfd88f26a63413a07551.dll
Size

301KB
MD5

70af0cf0f433dfd88f26a63413a07551
SHA1

e321c899c2c54654ec5d8d8ca5ced388d29fb0f5
SHA256

7de7f3ce2c1c10339d2ab756f29c346159e47bd70ac13c8f1cc747bf8fd69362
SHA512

80e881b623f94d02e638cbe823453adb04f32c8aac815aa21f4efe6f006731680feba831365767ca3ccb659bfa618d35ac23452064ab3ba44de8515e4499dfd4
SSDEEP

6144:jMNqJ4lOom0dwWxArZNFjvQRUDqCszzdkjrCpc0NwIrpgurS7dB4Fwt:jMPlOom0dwTrztIRUOCsinCm0NwzurSd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	2196	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2196	2296	rundll32.exe	89
PID 2296 wrote to memory of 2196	2296	rundll32.exe	89
PID 2296 wrote to memory of 2196	2296	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\70af0cf0f433dfd88f26a63413a07551.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\70af0cf0f433dfd88f26a63413a07551.dll,#1
  2⤵
  PID:2196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 596
    3⤵
    - Program crash
    PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2196 -ip 2196
1⤵
PID:4032