520bc6b805ebc410ce75a09c67f251c7158b6003b2319d5288d653b75f6b52f0

Analysis

max time kernel
166s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 20:59

Target

03d7e041ab34f2e8ee8e9c8c1cc0cf98.dll
Size

120KB
MD5

03d7e041ab34f2e8ee8e9c8c1cc0cf98
SHA1

1d9c389d1757e14c718c134794cae86e98d4ed6a
SHA256

520bc6b805ebc410ce75a09c67f251c7158b6003b2319d5288d653b75f6b52f0
SHA512

b2dc8c4ea543c9837aafec432e0b2b2a577132ef56bd2e9443d04f5f0b7d9fe1b0b10990be2f6208bf4a298e15ef4e5d191a1904b326a62e2cf46afc478755aa
SSDEEP

3072:xSSyvpchqyqqgbUfhLuYTNN7CANTxzQEFc2gFn88aWU38o8z6cRsd5:USGMqBbIuU3qEe2InfaBC6cRs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3580	2636	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 2636	3336	rundll32.exe	88
PID 3336 wrote to memory of 2636	3336	rundll32.exe	88
PID 3336 wrote to memory of 2636	3336	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03d7e041ab34f2e8ee8e9c8c1cc0cf98.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\03d7e041ab34f2e8ee8e9c8c1cc0cf98.dll,#1
  2⤵
  PID:2636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 604
    3⤵
    - Program crash
    PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2636 -ip 2636
1⤵
PID:3660

memory/2636-0-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download