e32401da33702a078b434fc8a3e8270d17c3df6647a4683fe8618cf492d1202e

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 06:20

Target

10eb82d562a462052b4013e4af8615cf.dll
Size

62KB
MD5

10eb82d562a462052b4013e4af8615cf
SHA1

ada82bb8e3d281019023ab073ae7aea513b46fee
SHA256

e32401da33702a078b434fc8a3e8270d17c3df6647a4683fe8618cf492d1202e
SHA512

f11c4a5e6ca7e6539df76d8061855d9e425f4c6e606555fe2ea0dcd1176cdf179ec48272fe234a9a3bebcc4faee86e77b965b33d85c90b42c45d949c995d7d5c
SSDEEP

768:ZQ/BqAAAdasuMRVhBUphv3bUPHRWaaan3FUr5h6EmNS6:ZeBqAAc/ukBUAGG3F05NmNS6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	1548	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1548	1816	rundll32.exe	16
PID 1816 wrote to memory of 1548	1816	rundll32.exe	16
PID 1816 wrote to memory of 1548	1816	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10eb82d562a462052b4013e4af8615cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\10eb82d562a462052b4013e4af8615cf.dll,#1
  2⤵
  PID:1548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 564
    3⤵
    - Program crash
    PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1548 -ip 1548
1⤵
PID:3908

memory/1548-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download