79b8c2ad3cb65587585796ab02dd978f74aa9977603d62f43ec6ac2c53acbbce

Analysis

max time kernel
142s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 18:12

Target
002612b0f60b3c1b8a11ecb41774cb6d.dll
Size 1.1MB
Sample231229-wthxesfghp
SHA256 79b8c2ad3cb65587585796ab02dd978f74aa9977603d62f43ec6ac2c53acbbce
MD5 002612b0f60b3c1b8a11ecb41774cb6d
SHA1 aea481a4d12de1f130c4b468fa3fe1b45abb8cdb
SHA512 93e7c8dd4b1cdc6fe99294e4680ee82b5ae3c9b4bebb181bea9c1bb4ddf57c8457237898965fb6d818480a685cff43004c4765638cbbb526f2c695c16c2d8e2c
SSDEEP 24576:a2J7VRxHcgGvQoQmN8tGqWmQd/Wjq2KcRZJxxHIfNGpPx:aWTxcCg+jq8jXxHIfwpp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2608	1976	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 1976	3548	rundll32.exe	88
PID 3548 wrote to memory of 1976	3548	rundll32.exe	88
PID 3548 wrote to memory of 1976	3548	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\002612b0f60b3c1b8a11ecb41774cb6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\002612b0f60b3c1b8a11ecb41774cb6d.dll,#1
  2⤵
  PID:1976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 680
    3⤵
    - Program crash
    PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1976 -ip 1976
1⤵
PID:1640

memory/1976-0-0x0000000000400000-0x00000000004E3000-memory.dmp

Download