9d4ffe805274017f0c5d950382e8839001711c6f7deb3dc4112ff0bc382f1fc9

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 23:18

Target

06b6ea48a598824ef8107441ea6f0635.dll
Size

87KB
MD5

06b6ea48a598824ef8107441ea6f0635
SHA1

32fd48b079a4cdef2e18b3c1971a0af760c873ed
SHA256

9d4ffe805274017f0c5d950382e8839001711c6f7deb3dc4112ff0bc382f1fc9
SHA512

cc29af477c4dae3a8437f38c78156938f85352e222da2c559c2981503db52624bcc7d4576324862e6f38c98c22c01b88233c9fb202eebb406af38e8bb5d7bbc0
SSDEEP

1536:EaEMIPFyi4lxxP2eFzzUvO+LhwsgGrJLJ/JTtpZKqA8I:EaVEaxx9iOGhV5JLp9Q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5008	4956	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 4956	4972	rundll32.exe	88
PID 4972 wrote to memory of 4956	4972	rundll32.exe	88
PID 4972 wrote to memory of 4956	4972	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06b6ea48a598824ef8107441ea6f0635.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06b6ea48a598824ef8107441ea6f0635.dll,#1
  2⤵
  PID:4956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 548
    3⤵
    - Program crash
    PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4956 -ip 4956
1⤵
PID:3516

memory/4956-0-0x0000000010000000-0x000000001002F000-memory.dmp

Filesize
188KB

Download