cb89c1cfdf11738bf1b9b6c3a73c69804b39b31d34d27b691c669683b0592a37

Analysis

max time kernel
136s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 00:03

Target

07e85b7244b64424da4ac272ed6e878d.dll
Size

44KB
MD5

07e85b7244b64424da4ac272ed6e878d
SHA1

7009479132b0ffe23d9325b4b8b8f50fd82112a1
SHA256

cb89c1cfdf11738bf1b9b6c3a73c69804b39b31d34d27b691c669683b0592a37
SHA512

b4c569c6a4619d75e40e1a8eb09570ee8a5006675cfc9270c9b8afbee84648f13fa3fac8bd0e76b8685d5953f291ae7798ab187397b847e90c3e03fd39948d93
SSDEEP

768:Qlm8GuGrUvGSRAHYKoGyYQQNBeJXlK01GBM2hBBQARQkeElA1:i3GLORA0GBM2hBBQAR9a

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4580	3140	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 3140	632	rundll32.exe	15
PID 632 wrote to memory of 3140	632	rundll32.exe	15
PID 632 wrote to memory of 3140	632	rundll32.exe	15

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07e85b7244b64424da4ac272ed6e878d.dll,#1
1⤵
PID:3140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 568
  2⤵
  - Program crash
  PID:4580

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07e85b7244b64424da4ac272ed6e878d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3140 -ip 3140
1⤵
PID:1084