094334cc79a798b6c7976e494186c572b04b1507989e3228b274982e76ee8b17

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:36

Target

05ca562df84451922ed44e2f3ae94a34.dll
Size

8KB
MD5

05ca562df84451922ed44e2f3ae94a34
SHA1

8eefb360df997dacd91cb4b8a23227caa2e7d55e
SHA256

094334cc79a798b6c7976e494186c572b04b1507989e3228b274982e76ee8b17
SHA512

308a6fcb662e5e6cc3e5e59fcd542a0c0def52d5275174d662fee35660d05201e97796424eb63a9e1efc7dbc48e6ee511a2067b07a1dfd531b8761def129e1fb
SSDEEP

192:VUFK5OJ+J3J22koZ7F3FYqtOgdn7SmPdk0czumuelnkZS:aGOwJ3jXR3FPtVlPMumu23

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4688	2476	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2476	2544	rundll32.exe	16
PID 2544 wrote to memory of 2476	2544	rundll32.exe	16
PID 2544 wrote to memory of 2476	2544	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05ca562df84451922ed44e2f3ae94a34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\05ca562df84451922ed44e2f3ae94a34.dll,#1
  2⤵
  PID:2476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 544
    3⤵
    - Program crash
    PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2476 -ip 2476
1⤵
PID:1384

memory/2476-0-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download