16432777107699feeee1bbc080aa4917d5f5d6fe5d2e29253123445f5199ec84

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 09:17

Target

144a25d5b5ec3ddde37e3ab98b88a394.dll
Size

145KB
MD5

144a25d5b5ec3ddde37e3ab98b88a394
SHA1

f459a3fbda2cd439b54b43fb047623c5436d4644
SHA256

16432777107699feeee1bbc080aa4917d5f5d6fe5d2e29253123445f5199ec84
SHA512

a5f8426d97eb6e49c155499221740ed0a0038d446d79552bb6814692f07a2510f7619978ba61e0c8d15730d10fb3fabee0dad7aca300d3fdf0bc6dc07ce4a15d
SSDEEP

3072:FzZkFJElOuXRCLT3AGtVZIrV7Nlqc+6/rAHz6zqr+PhIOL8ogGUNm5x6gci7:FzZTOuhCPwGtV2dNX8LoXTgwHJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4404	3556	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3556	1104	rundll32.exe	25
PID 1104 wrote to memory of 3556	1104	rundll32.exe	25
PID 1104 wrote to memory of 3556	1104	rundll32.exe	25

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\144a25d5b5ec3ddde37e3ab98b88a394.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\144a25d5b5ec3ddde37e3ab98b88a394.dll,#1
  2⤵
  PID:3556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 584
    3⤵
    - Program crash
    PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3556 -ip 3556
1⤵
PID:2324

memory/3556-0-0x0000000000C90000-0x0000000000CB7000-memory.dmp

Filesize
156KB

Download
memory/3556-1-0x0000000000C90000-0x0000000000CB7000-memory.dmp

Filesize
156KB

Download
memory/3556-2-0x0000000000C90000-0x0000000000CB7000-memory.dmp

Filesize
156KB

Download