19701b6172156b7b18a7fe801d1eac74ca4659a0d3831e202fbc70838ef7d63b

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 08:03

Target

12e9824ce324feb6e6eb4eecf0c169e8.dll
Size

28KB
MD5

12e9824ce324feb6e6eb4eecf0c169e8
SHA1

03a5ed62a4e3ce2905ba9b6f1e705c26979ca3f7
SHA256

19701b6172156b7b18a7fe801d1eac74ca4659a0d3831e202fbc70838ef7d63b
SHA512

c0add20bc1f0ec7d3590aa7f043c1efe5a83d0c6ed93b327a69c56b54497a43beb8d4935073902581949a8245f9b92a2162357c1ec9db3a3381daa7048aa9d7a
SSDEEP

384:2CaEepgsGOCmOoQPBZQUQ5yOEP/iHIeekK6XulD8ahHxTbvnHqpM2EJaUWVpr/FN:AOOvQP0iiolrGuJhHlbnOM2HVplIA39

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	4024	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 4024	2152	rundll32.exe	87
PID 2152 wrote to memory of 4024	2152	rundll32.exe	87
PID 2152 wrote to memory of 4024	2152	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12e9824ce324feb6e6eb4eecf0c169e8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12e9824ce324feb6e6eb4eecf0c169e8.dll,#1
  2⤵
  PID:4024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 560
    3⤵
    - Program crash
    PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4024 -ip 4024
1⤵
PID:3324

memory/4024-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download