95810f2dbc80c98fbf5726ec54cea283379608b46b96982b078c11db1784399c

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 00:58

Target

094d84f9b372b6fefe60f0a65e2f04ea.dll
Size

115KB
MD5

094d84f9b372b6fefe60f0a65e2f04ea
SHA1

49e33f45d20ca49a2bbcecf9c8c831176aa71e94
SHA256

95810f2dbc80c98fbf5726ec54cea283379608b46b96982b078c11db1784399c
SHA512

5194bd3af93799ea12f8373c1bfce59cabc80fffd2cd19d0062d1b56c08f9161c8c628b0af599ff3ae329a7886627f3f398dcdbd21496ba301445721401dce76
SSDEEP

1536:mRSQ9aAOz+jMZPeERFaysktck0YDUj5DzndYCwyTVPdpKPH3zogC:mbYesWERp/Dmzd/wbPH3zog

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
636	4328	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4328	5104	rundll32.exe	85
PID 5104 wrote to memory of 4328	5104	rundll32.exe	85
PID 5104 wrote to memory of 4328	5104	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\094d84f9b372b6fefe60f0a65e2f04ea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\094d84f9b372b6fefe60f0a65e2f04ea.dll,#1
  2⤵
  PID:4328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 600
    3⤵
    - Program crash
    PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4328 -ip 4328
1⤵
PID:1936