7be47870030872b1ca25e376a512b94dfa4a7e8e4572b7c6ce01efa0f7245999

Analysis

max time kernel
133s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:53

Target

12afb898bf770f92602dd3afe8f75309.dll
Size

512KB
MD5

12afb898bf770f92602dd3afe8f75309
SHA1

3ad84367bbab522a09082360b2974803c10611da
SHA256

7be47870030872b1ca25e376a512b94dfa4a7e8e4572b7c6ce01efa0f7245999
SHA512

ab89c9a13f474560f18bbc65dd19f46f62917269407ff0b3c066ca659d5985bef653c7a6367002b1492a64658bc6a8eafb1f7fd1ff8a1ffaf1514a008f356bba
SSDEEP

12288:bE0dszx+rMG5ACFfp5wBOcXSJHAa3/UqdIEqL9H:re9+YG5ACFR5wBOcCHcq3kH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1908	2024	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 2024	3924	rundll32.exe	14
PID 3924 wrote to memory of 2024	3924	rundll32.exe	14
PID 3924 wrote to memory of 2024	3924	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12afb898bf770f92602dd3afe8f75309.dll,#1
1⤵
PID:2024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 576
  2⤵
  - Program crash
  PID:1908

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12afb898bf770f92602dd3afe8f75309.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2024 -ip 2024
1⤵
PID:1824

memory/2024-0-0x0000000060040000-0x00000000600C1000-memory.dmp

Filesize
516KB

Download