c73b88901792f0a622fa3c5e3e2a5283bbdbcfa0ea3ee8edc1c6c8fd014dd5e0

Analysis

max time kernel
137s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 04:12

Target

0e05f74b1adf593ad8d80132124df0f3.dll
Size

30KB
MD5

0e05f74b1adf593ad8d80132124df0f3
SHA1

1cd3ac0a16c4d438c53c32a0c4d8d4b1dad6ac29
SHA256

c73b88901792f0a622fa3c5e3e2a5283bbdbcfa0ea3ee8edc1c6c8fd014dd5e0
SHA512

297f9d49c56a9756421325f71fa6526b8ac46e2173ebe2f518226e9f268e6588849ef4205376cad5d9833d30ec03f2124132289393e7d3a45b2c4feba6d51ca1
SSDEEP

768:sFXtulH7emikByc/ff/Rh7A958qR/CKGnVCZoI9OmzTwl:sF9QbekMeff/R5A95zR/zGnUZo3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	720	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 720	1732	rundll32.exe	16
PID 1732 wrote to memory of 720	1732	rundll32.exe	16
PID 1732 wrote to memory of 720	1732	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e05f74b1adf593ad8d80132124df0f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e05f74b1adf593ad8d80132124df0f3.dll,#1
  2⤵
  PID:720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 552
    3⤵
    - Program crash
    PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 720 -ip 720
1⤵
PID:3768

memory/720-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download