ead509e13e827d9bd60f7db952a47e3abeea7ca15ac864cabd3b0871280f2d51

Analysis

max time kernel
132s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 15:07

Target

77db9083932fca0e4783ae50d7c1b4a5.dll
Size

28KB
MD5

77db9083932fca0e4783ae50d7c1b4a5
SHA1

be85b78c4a41bcc9fbe232b7efe02740cb238705
SHA256

ead509e13e827d9bd60f7db952a47e3abeea7ca15ac864cabd3b0871280f2d51
SHA512

0704d1891f13968cc17551e6a191cf05aef875b68e008732a758d99a45d119d8893c31dfd69e2e48de5035680868ed3cd0064f9b1b7ed1a71fe60d2f08671216
SSDEEP

384:WJzBUga6XKKWqGiecGUAGzvSLm5musuJf+qvX/zEv2fIgOvr3p331dRMRetQliXy:wdaKWN0GpSqLm5muiqvX5I9cRDE2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	3880	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 3880	2624	rundll32.exe	88
PID 2624 wrote to memory of 3880	2624	rundll32.exe	88
PID 2624 wrote to memory of 3880	2624	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77db9083932fca0e4783ae50d7c1b4a5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\77db9083932fca0e4783ae50d7c1b4a5.dll,#1
  2⤵
  PID:3880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 636
    3⤵
    - Program crash
    PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3880 -ip 3880
1⤵
PID:1416