03849eb007d8cc569d10877ddf6d80dae5620aa0c13cbda644e0244a324afb23

Analysis

max time kernel
142s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 04:00

Target

0db78fbea4906031f37d11feb1125576.dll
Size

14.9MB
MD5

0db78fbea4906031f37d11feb1125576
SHA1

e48ee087d2bb6eee326a7d2bf3d9899a54a681e2
SHA256

03849eb007d8cc569d10877ddf6d80dae5620aa0c13cbda644e0244a324afb23
SHA512

e7128b7d10e4307ccb5858846ab25f3f992aad6c07662e3021c9cc19b18852c9856bb45b3eb5f9141f281ad7af0c5b6497e431052dbe05eb3c3900b53b918226
SSDEEP

393216:+Xoyiomujym6tXoyiomujym6NXoyiomujym6tXoyiomujym6:+XonomujyJtXonomujyJNXonomujyJt4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3196	2960	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 2960	4968	rundll32.exe	18
PID 4968 wrote to memory of 2960	4968	rundll32.exe	18
PID 4968 wrote to memory of 2960	4968	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0db78fbea4906031f37d11feb1125576.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0db78fbea4906031f37d11feb1125576.dll,#1
  2⤵
  PID:2960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 612
    3⤵
    - Program crash
    PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2960 -ip 2960
1⤵
PID:3668