1bc664891569f7ba30253cbd42f5eb59eb42150bf01ccda84138d5989335aff9

Analysis

max time kernel
140s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:35

Target

0719b51487c2a279067211c21740dfb3.dll
Size

56KB
MD5

0719b51487c2a279067211c21740dfb3
SHA1

30c0c3638750bb1614ef0bb3968a737ab7a2976d
SHA256

1bc664891569f7ba30253cbd42f5eb59eb42150bf01ccda84138d5989335aff9
SHA512

9c9aa99e49ac33ef2799bc1991a6c64d632a6e95493c06576017775ad12fdd4bf4b5a57a5dbf913d8546385fee7d843d4224cf6e55c11887e9926cbe9c15234b
SSDEEP

768:2reg9zOOSaHkq+fjC2nqszu0Un3S/xho8MrgCxrfD:2rlCOFHv+fjC2n6NixLbMrL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2424	1744	WerFault.exe	24

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1744	2216	rundll32.exe	24
PID 2216 wrote to memory of 1744	2216	rundll32.exe	24
PID 2216 wrote to memory of 1744	2216	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0719b51487c2a279067211c21740dfb3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0719b51487c2a279067211c21740dfb3.dll,#1
  2⤵
  PID:1744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 616
    3⤵
    - Program crash
    PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1744 -ip 1744
1⤵
PID:856

memory/1744-0-0x0000000000FF0000-0x0000000000FFE000-memory.dmp

Filesize
56KB

Download