e55c7b3a56b807f31c8d68bf8c157da9e80522a60a3e4d3be90e101ff85c9ef8

Analysis

max time kernel
152s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 21:31

Target

f9881c6c96dbc5d18764ba0a11b45f91.dll
Size

127KB
MD5

f9881c6c96dbc5d18764ba0a11b45f91
SHA1

b572ff448413b40259b48b288eb8c91e70b6186c
SHA256

e55c7b3a56b807f31c8d68bf8c157da9e80522a60a3e4d3be90e101ff85c9ef8
SHA512

4bce771d25286fce7570165e82dadf6f6dbbac1760afd7bd2f0c6262c2509b7c595b1c963b4a83314fcf5ae39779081ffdc905360351ba5fdd73e2c52fc8300c
SSDEEP

3072:ifC0OGQDdZJPESvZPHojlJ6+NOctcUoDthgM3X73OL5PFn0wcccccccc:MfOBvvVHojq+FoDAs30PFn0wcccccccc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4804	2544	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2544	2300	rundll32.exe	85
PID 2300 wrote to memory of 2544	2300	rundll32.exe	85
PID 2300 wrote to memory of 2544	2300	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9881c6c96dbc5d18764ba0a11b45f91.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9881c6c96dbc5d18764ba0a11b45f91.dll,#1
  2⤵
  PID:2544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 556
    3⤵
    - Program crash
    PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2544 -ip 2544
1⤵
PID:3028