544efd8af9f5fb0b397f8ec54350302725460592d7fa96f759e73357680a89ef

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:29

Target

1227a3c301020c1f5549cd97ca44df58.dll
Size

81KB
MD5

1227a3c301020c1f5549cd97ca44df58
SHA1

81d3e36f4876afa022494fd820a6e159e1f530a3
SHA256

544efd8af9f5fb0b397f8ec54350302725460592d7fa96f759e73357680a89ef
SHA512

c7a8b5e6f57eec787fa1186c59e16d35a86e694f1f05f4f8aeb3f35384e25c32df4469afb1e1448071dc2cea7379985da6def4eea10486902f92186fe0eb619a
SSDEEP

1536:j3juL3Pd5mW36qSDwhcKSTfmw8RTAYRbJPLonkXa:j3sPWpXwhlSzmw8uYRbJPLonk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1620	3976	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 3976	1564	rundll32.exe	87
PID 1564 wrote to memory of 3976	1564	rundll32.exe	87
PID 1564 wrote to memory of 3976	1564	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1227a3c301020c1f5549cd97ca44df58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1227a3c301020c1f5549cd97ca44df58.dll,#1
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 696
    3⤵
    - Program crash
    PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3976 -ip 3976
1⤵
PID:1136