508d178d8dfc2047d8cb4d4d885bbcce43c04f2e8c8d885162fa9b098f782b0a

Analysis

max time kernel
146s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 20:32

Target

f62b04d09d6dd80ec22d9465ed203161.dll
Size

183KB
MD5

f62b04d09d6dd80ec22d9465ed203161
SHA1

66bfd13751c272143e3a5420d6930a394e68171e
SHA256

508d178d8dfc2047d8cb4d4d885bbcce43c04f2e8c8d885162fa9b098f782b0a
SHA512

8e3c9d6d7ac17a39be17329d10f2ff04b615bd970a075e3f64b2b2ec838e186afb8f80842462c4d02749c279b01d7b604967812efff54157f4c44e0abaddaf6b
SSDEEP

3072:Wp7JJAISXmn11O913E8DguNOLtD4/9d8TmgippRlEmEeGjDf1v:m281KJE8DVNO5aqm/LEJhv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2968	816	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 816	3340	rundll32.exe	14
PID 3340 wrote to memory of 816	3340	rundll32.exe	14
PID 3340 wrote to memory of 816	3340	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f62b04d09d6dd80ec22d9465ed203161.dll,#1
1⤵
PID:816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 556
  2⤵
  - Program crash
  PID:2968

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f62b04d09d6dd80ec22d9465ed203161.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 816 -ip 816
1⤵
PID:864