9c0e9a27c21290673b082173211f6a79a4b44fe7cf9ce654561b97eaddf6328f

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 11:18

Target

16f6f204cb5ad036d623d2caca334fd5.dll
Size

66KB
MD5

16f6f204cb5ad036d623d2caca334fd5
SHA1

a27b8f5113e160e000e3359e1a797a91335a7748
SHA256

9c0e9a27c21290673b082173211f6a79a4b44fe7cf9ce654561b97eaddf6328f
SHA512

5a0a6faa6c55de2f276790c269589514a1b6dd2db25b957014e3282bf6f88a11f1bf790daddcec9b3bcfbe7a095f54d5894532d26e78843ab7dd3e611c511b08
SSDEEP

1536:bfq5JE9lmUsOwg2/ck06d+bgxxU9Or3Z3hhRJaQExGxVWLY:boJE9lmj90Tbyr335EOV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3828	2272	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 2272	5040	rundll32.exe	89
PID 5040 wrote to memory of 2272	5040	rundll32.exe	89
PID 5040 wrote to memory of 2272	5040	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16f6f204cb5ad036d623d2caca334fd5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16f6f204cb5ad036d623d2caca334fd5.dll,#1
  2⤵
  PID:2272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 772
    3⤵
    - Program crash
    PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2272 -ip 2272
1⤵
PID:4664