28e3b5e25bd760ab28f0652daf21f9337287397973892b61cf0f3374fb5a1d3c

Analysis

max time kernel
128s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 00:47

Target

090305209dcc33a32cb458fa0d664f5c.dll
Size

9KB
MD5

090305209dcc33a32cb458fa0d664f5c
SHA1

18ce658f5f482338696dde35304d780dd8237ea1
SHA256

28e3b5e25bd760ab28f0652daf21f9337287397973892b61cf0f3374fb5a1d3c
SHA512

edc37cf2abf0745f8d86ff67e81beeaa3b28fc0c0059ed70a20eacf24d7f6b85f1b885ec5c051a9723d304c68a317b8d31a8bd0ea5ba476a3a29d8049403870d
SSDEEP

96:q1V7dR7uwEU+hCT3GrxZ4MUtPNlz0MdG8EWvdM3IWwG34bs5:kuwEt8rsTUtPLzKNWSYWF4bs5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3008	5032	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 5032	2632	rundll32.exe	87
PID 2632 wrote to memory of 5032	2632	rundll32.exe	87
PID 2632 wrote to memory of 5032	2632	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\090305209dcc33a32cb458fa0d664f5c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\090305209dcc33a32cb458fa0d664f5c.dll,#1
  2⤵
  PID:5032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 632
    3⤵
    - Program crash
    PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5032 -ip 5032
1⤵
PID:2788

memory/5032-0-0x0000000076F90000-0x0000000076F97000-memory.dmp

Filesize
28KB

Download
memory/5032-1-0x0000000076F90000-0x0000000076F97000-memory.dmp

Filesize
28KB

Download