e6190ddde75fe7bfefb5ae539bf2becf71d5e8952606dff992b10df3af70ec4b

Analysis

max time kernel
136s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 13:37

Target

72d0f938f263af6b8c6ef940afd68264.dll
Size

116KB
MD5

72d0f938f263af6b8c6ef940afd68264
SHA1

960087534f25c2018d0e0b840abb8aa63dca36e2
SHA256

e6190ddde75fe7bfefb5ae539bf2becf71d5e8952606dff992b10df3af70ec4b
SHA512

b90640a7355767a68e865bb0abbaad4dd309f4bb54f91e6f5974ed70e1c624c28e0b42a295ab1c296531903b11d326e59b4ad28a6f71423b4ab0f664a1c23c19
SSDEEP

3072:Y6O65y49XXAgWRY/WJEp0CmOjwbGzSYYLT4ESk8Qz:YMP9XeUWEpLmOj7CT4ESk8+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
764	1104	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1104	1876	rundll32.exe	89
PID 1876 wrote to memory of 1104	1876	rundll32.exe	89
PID 1876 wrote to memory of 1104	1876	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72d0f938f263af6b8c6ef940afd68264.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72d0f938f263af6b8c6ef940afd68264.dll,#1
  2⤵
  PID:1104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 540
    3⤵
    - Program crash
    PID:764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1104 -ip 1104
1⤵
PID:4692