a0c2165115fbf0ceae4c7f90f2583f40da15b7a3e27ab8e49a282aab897bce40

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 22:32

Target

1e8be6319aaaeef9cb154c937a8ae0f3.dll
Size

28KB
MD5

1e8be6319aaaeef9cb154c937a8ae0f3
SHA1

c341f9de3d38b1c398e8d476e82c15226d694faa
SHA256

a0c2165115fbf0ceae4c7f90f2583f40da15b7a3e27ab8e49a282aab897bce40
SHA512

a6918341f61551585ba088e815841d2732bb6fa6706ad101d1f696d6d855348161cf5411aaf1c3dd569fd06b40139df1e43beea45b8b8c2a339b6fb661636aa6
SSDEEP

384:em0FAMfs2m61+6HBS9RE+5pOwdDyxGj14tPb5GY52g1aygBqJWTEktg01dH:YFlLKOiDyiStj5GeCUJMEka01

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4552	4068	WerFault.exe	57

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 4068	2500	rundll32.exe	57
PID 2500 wrote to memory of 4068	2500	rundll32.exe	57
PID 2500 wrote to memory of 4068	2500	rundll32.exe	57

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e8be6319aaaeef9cb154c937a8ae0f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e8be6319aaaeef9cb154c937a8ae0f3.dll,#1
  2⤵
  PID:4068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 560
    3⤵
    - Program crash
    PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4068 -ip 4068
1⤵
PID:2432

memory/4068-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download