255efabe7d98aa5e29016f470076cd6e40fd8cf5295d84586365672e87056223

Analysis

max time kernel
140s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 09:15

Target

143e6d00697568e93eebbdcae65ed032.dll
Size

93KB
MD5

143e6d00697568e93eebbdcae65ed032
SHA1

c8e736fd4c41de5555bbe99099fbba47f1c22413
SHA256

255efabe7d98aa5e29016f470076cd6e40fd8cf5295d84586365672e87056223
SHA512

6d740fac6a602121c2c2879b8f75823c8bc99a68eb62ccd35e2d4942e1921448b578a6a4b65a34bab614dce1d0b72b595b88e20a872e3a06347b4f77a6c33af3
SSDEEP

1536:oVSRyIIMeVeGiStiFocGBSSatnHu5yDH1jCm3z4YLMWYVEB2pIJ4IeZBAFMhowBb:oVSHIzVeGiStiFbGBNatOOjCmje/VEBB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1048	5108	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 5108	2580	rundll32.exe	14
PID 2580 wrote to memory of 5108	2580	rundll32.exe	14
PID 2580 wrote to memory of 5108	2580	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\143e6d00697568e93eebbdcae65ed032.dll,#1
1⤵
PID:5108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 548
  2⤵
  - Program crash
  PID:1048

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\143e6d00697568e93eebbdcae65ed032.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5108 -ip 5108
1⤵
PID:4300

memory/5108-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download