d0035654fd9942d7006c66920f536c977a08ee55b1ec66c1347802b413792b95

Analysis

max time kernel
142s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 20:54

Target

f780a2b70ce7f216a3d76b2da1bbf729.dll
Size

44KB
MD5

f780a2b70ce7f216a3d76b2da1bbf729
SHA1

dd21ac9d7e9f1902b3c9d3ee795c666581ca2364
SHA256

d0035654fd9942d7006c66920f536c977a08ee55b1ec66c1347802b413792b95
SHA512

e37002ef9b0014414e117f3005a45b35d60cd7c69e07dbba26c0da43ff8678e6c82682f7ae60f9b4d79bd5f4130156895d99793ffd7f68b967ecc7587d104463
SSDEEP

768:Qlm8GuGrUvGSRAHYKoGyYQQNBeJXlK01GBM2hBBQARQkeElAl:i3GLORA0GBM2hBBQAR9S

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2728	4400	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 4400	2656	rundll32.exe	14
PID 2656 wrote to memory of 4400	2656	rundll32.exe	14
PID 2656 wrote to memory of 4400	2656	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f780a2b70ce7f216a3d76b2da1bbf729.dll,#1
1⤵
PID:4400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 560
  2⤵
  - Program crash
  PID:2728

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f780a2b70ce7f216a3d76b2da1bbf729.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4400 -ip 4400
1⤵
PID:1008