aad6089c3d618ac217d1404a33b2f6e6bae06a7018eee50ace16f8c5ebceecae

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:36

Target

0722e4e0984ad20fe02c52840a362c84.dll
Size

7.6MB
MD5

0722e4e0984ad20fe02c52840a362c84
SHA1

f59b2cd6bda5dfc0e920f3acf24dffd2d0018715
SHA256

aad6089c3d618ac217d1404a33b2f6e6bae06a7018eee50ace16f8c5ebceecae
SHA512

adce6db69ae25195f69807bef3725e2548b00f3bc2d6ad3a9367bf7a5aaacf16921873bc3476212c03f835eb50e3431caaa1e7917e316b8521d827b5470d4cf0
SSDEEP

196608:WBF1FSktimYdfz6T3Ddqd2JECvGKvDKCcwyouRwk2OGQXQxzZ:2FTSkkmYdfGdqQJEC5i5lgxzZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1280	2736	WerFault.exe	18

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2736	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 2736	396	rundll32.exe	18
PID 396 wrote to memory of 2736	396	rundll32.exe	18
PID 396 wrote to memory of 2736	396	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0722e4e0984ad20fe02c52840a362c84.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0722e4e0984ad20fe02c52840a362c84.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 752
    3⤵
    - Program crash
    PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2736 -ip 2736
1⤵
PID:4364