b44be8bdacae50bd182c306319b575de55e33d3b89bd986763f76af09bb1e19b

Analysis

max time kernel
153s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 02:58

Target

0c536d3e78c4530283333c3078602ccc.dll
Size

26KB
MD5

0c536d3e78c4530283333c3078602ccc
SHA1

d15c07143a3876c1ccb140ed12fbef3636528316
SHA256

b44be8bdacae50bd182c306319b575de55e33d3b89bd986763f76af09bb1e19b
SHA512

dd6107d113450fd9622a9693c005045808de99334cdeb4fdf13d54faa8f92a7cd3f173d7060786dfcee341cb099c5c54a9ea50c8ddc61b137990415c5afa6e6c
SSDEEP

384:hAHxUSoqujqPKnGQuvKzsbRtko13RjOvl2nATpYU/BM2KFIAzAZOp:qKSoqueP0GQZzottpOvw6nZeFtAZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3464	3456	WerFault.exe	52

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 3456	856	rundll32.exe	52
PID 856 wrote to memory of 3456	856	rundll32.exe	52
PID 856 wrote to memory of 3456	856	rundll32.exe	52

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c536d3e78c4530283333c3078602ccc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c536d3e78c4530283333c3078602ccc.dll,#1
  2⤵
  PID:3456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 640
    3⤵
    - Program crash
    PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 3456 -ip 3456
1⤵
PID:4548

memory/3456-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download