1abd3186cebc2476687979e7d35826ae0fd545bbcab61bfd6e523c83df3789f3

Analysis

max time kernel
125s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:13

Target

0e10c48956844f06a0a4dd49ca339cd1.dll
Size

31KB
MD5

0e10c48956844f06a0a4dd49ca339cd1
SHA1

ecbd1da9d8706d2d390805a3f47f66f89989315b
SHA256

1abd3186cebc2476687979e7d35826ae0fd545bbcab61bfd6e523c83df3789f3
SHA512

3c8deea3f5e4238038276b1c0f94d989f08e1f768578379c13a592d4b4770fdf6d44ca4b88ba1d7f1c960e66abf0751dcf1c1d61da74a4fcb0c8f498ea25edcc
SSDEEP

768:mKXkdYAQqqnGbngkOZxl7ffxzuo7ificWSR6R5U4qauTB0TeX:mKXiNaGbgkuhfUo7i5Wq63eauTBo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4024	4744	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 4744	4360	rundll32.exe	14
PID 4360 wrote to memory of 4744	4360	rundll32.exe	14
PID 4360 wrote to memory of 4744	4360	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e10c48956844f06a0a4dd49ca339cd1.dll,#1
1⤵
PID:4744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 548
  2⤵
  - Program crash
  PID:4024

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e10c48956844f06a0a4dd49ca339cd1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4744 -ip 4744
1⤵
PID:3212

memory/4744-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download