37e54949c7a67462bb725a0e2b25b8b8777b642c13a164cb20a3c83385a8343b

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 22:46

Target

fdb5933b9749492fc09a3c6b8bc24626.dll
Size

14.3MB
MD5

fdb5933b9749492fc09a3c6b8bc24626
SHA1

2f1450a69ab3c1007e1f6a38517a4fcc2b538951
SHA256

37e54949c7a67462bb725a0e2b25b8b8777b642c13a164cb20a3c83385a8343b
SHA512

1a3898b4e448cb4226722e7c1a88492f4a499fc7416d7a54034c18875de97d91979a4a0ee25ab8c9682475069934c4fc6d1fa213be3180f48ca9a791ce505749
SSDEEP

98304:moh1uDd/dguKO1VaODwr22QsdciW+e1sWUscMG5F2e3pfE9Ycik:nkS3OD62eePDUGGF2e3sYO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
60	3448	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 3448	3724	rundll32.exe	15
PID 3724 wrote to memory of 3448	3724	rundll32.exe	15
PID 3724 wrote to memory of 3448	3724	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdb5933b9749492fc09a3c6b8bc24626.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdb5933b9749492fc09a3c6b8bc24626.dll,#1
  2⤵
  PID:3448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 776
    3⤵
    - Program crash
    PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3448 -ip 3448
1⤵
PID:1360

memory/3448-0-0x0000000002270000-0x00000000030D6000-memory.dmp

Filesize
14.4MB

Download
memory/3448-2-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/3448-3-0x0000000002270000-0x00000000030D6000-memory.dmp

Filesize
14.4MB

Download