87ddb17301597ceaec72d42fd1e7312af7d4f8346f012344c99ad0e32fc5e5f6

Analysis

max time kernel
148s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 18:32

Target

0090215cbded16ed9ca3a3122d11abeb.dll
Size

129KB
MD5

0090215cbded16ed9ca3a3122d11abeb
SHA1

f6529b015e24743c6b82eb8fb4ad9f32727cdc77
SHA256

87ddb17301597ceaec72d42fd1e7312af7d4f8346f012344c99ad0e32fc5e5f6
SHA512

07ff99e7f1955ed9e44bcd38f2124f28a02c4d2d41666fc3ad52e014a6d8efa0d2e0899ad7176a5dbd63ee9e507c1442353b1d25028e5736473d60c359497961
SSDEEP

3072:nH4jyp58/2yZKetJ7k4vrX67kapwsZjgKk4XnMPyFYU58fucbtHk8O:H8aINtXr67RjgKks7NW3btHkd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	4804	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 4804	404	rundll32.exe	87
PID 404 wrote to memory of 4804	404	rundll32.exe	87
PID 404 wrote to memory of 4804	404	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0090215cbded16ed9ca3a3122d11abeb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0090215cbded16ed9ca3a3122d11abeb.dll,#1
  2⤵
  PID:4804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 560
    3⤵
    - Program crash
    PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4804 -ip 4804
1⤵
PID:1384

memory/4804-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download