c57f650774fd7efc520d4c63a387b8c6aeaa6eccd6cdbf4f32ca6696839df159

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 16:18

Target

7c1a3ca465d8eb7488bf5a84263b82ce.dll
Size

106KB
MD5

7c1a3ca465d8eb7488bf5a84263b82ce
SHA1

e97b4e8a881778613d20acff19dfdcc4a87669de
SHA256

c57f650774fd7efc520d4c63a387b8c6aeaa6eccd6cdbf4f32ca6696839df159
SHA512

c3cf4b96e23c433b62d1b8d97a37c2d1cdeaa533010e381d1e8ba6312d557dd867710540a713b38a585c342e5f450a96dd111be0a8b929a234c4f2fb3be4b7b9
SSDEEP

1536:TjqIKDSvaTBH/FDpEfCoOe3q6o6yQKYdv5jQKuGG5naq6pFnJDYxtueV9jiH9ad:l8SvaVtpoOeZisjQKuGtDYx4wzd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3408	4616	WerFault.exe	36

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 4616	4520	rundll32.exe	36
PID 4520 wrote to memory of 4616	4520	rundll32.exe	36
PID 4520 wrote to memory of 4616	4520	rundll32.exe	36

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c1a3ca465d8eb7488bf5a84263b82ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7c1a3ca465d8eb7488bf5a84263b82ce.dll,#1
  2⤵
  PID:4616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 640
    3⤵
    - Program crash
    PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4616 -ip 4616
1⤵
PID:1760

memory/4616-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download