c0f292c463a557fd09dedaf4d0b6e02845e76f5fa619499d763ff6e7ec251ba9

Analysis

max time kernel
132s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 11:59

Target

17cb83fa20e5d97451292ab6e5a06228.dll
Size

248KB
MD5

17cb83fa20e5d97451292ab6e5a06228
SHA1

49050c91df4e55a80ad937ce4fcb8e9659d3f1ad
SHA256

c0f292c463a557fd09dedaf4d0b6e02845e76f5fa619499d763ff6e7ec251ba9
SHA512

8386f54e4a9f212c66d6983ae178df65da674d2aee648a95466ffd2b041b17664d6d36e2487c6db8450206f99f26d4dbae2a5da5a5673e0fd8599be0d484e724
SSDEEP

3072:nuIQG5lmQIIxw8sCo6om9c/WmAc4cNdnUNs/8JyU4Voo8O+UBQvze0LxbuzZ7Sba:u9G5TIOe9dWmAj8Wyoo8O+UBQbe0h

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4232	2560	WerFault.exe	74

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 2560	4976	rundll32.exe	74
PID 4976 wrote to memory of 2560	4976	rundll32.exe	74
PID 4976 wrote to memory of 2560	4976	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17cb83fa20e5d97451292ab6e5a06228.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17cb83fa20e5d97451292ab6e5a06228.dll,#1
  2⤵
  PID:2560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 560
    3⤵
    - Program crash
    PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2560 -ip 2560
1⤵
PID:3968