5000c34bab1b4f9e1d12a951abed0023be903440842224211afc5893279a7131

Analysis

max time kernel
145s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:53

Target

12b2d7179c36dfc9ab0beae41377e477.dll
Size

64KB
MD5

12b2d7179c36dfc9ab0beae41377e477
SHA1

9391ad55752c8d7580521da6c83554dba798b228
SHA256

5000c34bab1b4f9e1d12a951abed0023be903440842224211afc5893279a7131
SHA512

ab156a3bdb80f83bb5cb61fd5af8310384e76d3cd87c9620d1d7dd929f9f8071aa42cf16970f4cf8669b8db0b9ab2329df5c3e911a1bfe97c04a231607b9ad77
SSDEEP

1536:0bqxW4XFYs77QO3/3lxJ/AcjMdsUBXvJqJwhCwwQjL:0bL4Xf3/vicjMdsmhqJw0ww8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	1492	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1492	1352	rundll32.exe	14
PID 1352 wrote to memory of 1492	1352	rundll32.exe	14
PID 1352 wrote to memory of 1492	1352	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12b2d7179c36dfc9ab0beae41377e477.dll,#1
1⤵
PID:1492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 644
  2⤵
  - Program crash
  PID:2524

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12b2d7179c36dfc9ab0beae41377e477.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1492 -ip 1492
1⤵
PID:2264