0a829688f0c75aacad962337339f2bd452ab3b491effcc9464d035dbad506ea5

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 05:36

Target

102190941b6bf79dfe2b5539a80c64c0.dll
Size

93KB
MD5

102190941b6bf79dfe2b5539a80c64c0
SHA1

fb203c552cbcd1ca5fb682c78dbe9cbb548706ee
SHA256

0a829688f0c75aacad962337339f2bd452ab3b491effcc9464d035dbad506ea5
SHA512

da1837d3a87af4bcd66580422f1adce64579a8a60ca325306c151f442d62810dd052a6d203888a57353fd6ff4f3aa4c87f00fafe8c289c2e4584190562a9496b
SSDEEP

1536:YpTOSxkKMhtGwgcKRtOvBzfFVFL97LU3y6xj3Xqo+tFjNbuoZlTUddB7CRtc9u:0TPxkB4FcYtOhrFLsn7qB1u86vURK9u

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4468	3504	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3504	3700	rundll32.exe	14
PID 3700 wrote to memory of 3504	3700	rundll32.exe	14
PID 3700 wrote to memory of 3504	3700	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\102190941b6bf79dfe2b5539a80c64c0.dll,#1
1⤵
PID:3504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 632
  2⤵
  - Program crash
  PID:4468

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\102190941b6bf79dfe2b5539a80c64c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3504 -ip 3504
1⤵
PID:4628