40783ff449fd035f82fd65ab251cee47fbfd1b4276ae243a91e7ad756c29cec0

Analysis

max time kernel
114s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:20

Target

06be022c183fd277251b17d4621f0cac.dll
Size

553KB
MD5

06be022c183fd277251b17d4621f0cac
SHA1

d8ae2adb7ece7ce13a406289e22d7102b3750674
SHA256

40783ff449fd035f82fd65ab251cee47fbfd1b4276ae243a91e7ad756c29cec0
SHA512

f3d52f3212c1b9e39c6ffd79639a4a2402daa630020f9b92afa3d8dcd744a5c704fbeece68b6b2630cfb8e6a04053f6aca960fda65d04805960dd68dcadd492e
SSDEEP

12288:MHqhRjx38eLkFhL5R8/LIg9xILqppWHsvKTewmaw9G7lxY:MHURjxlYFx8TIox69TfmX9GBxY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
896	5116	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 5116	2412	rundll32.exe	14
PID 2412 wrote to memory of 5116	2412	rundll32.exe	14
PID 2412 wrote to memory of 5116	2412	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06be022c183fd277251b17d4621f0cac.dll,#1
1⤵
PID:5116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 892
  2⤵
  - Program crash
  PID:896

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06be022c183fd277251b17d4621f0cac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5116 -ip 5116
1⤵
PID:4508

memory/5116-0-0x0000000076240000-0x0000000076330000-memory.dmp

Filesize
960KB

Download
memory/5116-4-0x0000000076710000-0x0000000076773000-memory.dmp

Filesize
396KB

Download
memory/5116-6-0x00000000743A0000-0x00000000743C1000-memory.dmp

Filesize
132KB

Download
memory/5116-7-0x0000000076240000-0x0000000076330000-memory.dmp

Filesize
960KB

Download
memory/5116-5-0x00000000744F0000-0x0000000074940000-memory.dmp

Filesize
4.3MB

Download
memory/5116-3-0x0000000076BC0000-0x0000000076E41000-memory.dmp

Filesize
2.5MB

Download
memory/5116-2-0x00000000749F0000-0x0000000074C74000-memory.dmp

Filesize
2.5MB

Download