1563c3a4436a1c19708bdba1d961c3eb8da182f82b23129cfb13ee6a25558d56

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 19:08

Target

014288ed928c69c229bae97bbcd976aa.dll
Size

276KB
MD5

014288ed928c69c229bae97bbcd976aa
SHA1

4bddc1861052738988c6970ae1bb571abc8ebd90
SHA256

1563c3a4436a1c19708bdba1d961c3eb8da182f82b23129cfb13ee6a25558d56
SHA512

b52296db2ab784a9cd35691ae99e1e3e284fa5b6f1938d0dcdb43214f66f10d441801369651faa2db2317e0473061b4f0000fc16f5a0aea0045399217f7f980e
SSDEEP

6144:dOSjIXo9jPDv5eisvDs8W7s9ZuJrUO//oOqzTzlUK/zNFe5kQn:k549zDUis7s8W7GYAOqWAMiQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2544	908	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 908	1940	rundll32.exe	14
PID 1940 wrote to memory of 908	1940	rundll32.exe	14
PID 1940 wrote to memory of 908	1940	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\014288ed928c69c229bae97bbcd976aa.dll,#1
1⤵
PID:908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 576
  2⤵
  - Program crash
  PID:2544

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\014288ed928c69c229bae97bbcd976aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 908 -ip 908
1⤵
PID:208

memory/908-0-0x00000000736D0000-0x000000007371C000-memory.dmp

Filesize
304KB

Download