9ebeef8be72c8139ac8483c5af83f898bdc19584c6225dd78b607c9fea214927

Analysis

max time kernel
141s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 11:40

Target
175f51a9573591fcef1cfe86c8c56e9a.dll
Size 23KB
Sample231230-ns7kdsabdr
SHA256 9ebeef8be72c8139ac8483c5af83f898bdc19584c6225dd78b607c9fea214927
MD5 175f51a9573591fcef1cfe86c8c56e9a
SHA1 a82e7fccd674e8892eaf91438de901b6eadbee09
SHA512 43c69f29c6f3fba9c650b9f04f9997cd528ef24901961d7a9e392b8a3e0f93afe7017da5165521b61c0d6e27c4734f2af6125366c27bb51c2b5a2befab04ef98
SSDEEP 384:WQntQXrGSn3ksp+GFHRKTsWkPBB9IFVTHqxkHe69RN3lJubQB36gsIoic2c:FM7n3ksphbNBeFVTHEyRvJubiqg/p
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4896	3672	WerFault.exe	77
4704	3672	WerFault.exe	77
448	3672	WerFault.exe	77

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 3672	3720	rundll32.exe	77
PID 3720 wrote to memory of 3672	3720	rundll32.exe	77
PID 3720 wrote to memory of 3672	3720	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\175f51a9573591fcef1cfe86c8c56e9a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\175f51a9573591fcef1cfe86c8c56e9a.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 196
    3⤵
    - Program crash
    PID:4896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 676
    3⤵
    - Program crash
    PID:4704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 656
    3⤵
    - Program crash
    PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3672 -ip 3672
1⤵
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3672 -ip 3672
1⤵
PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3672 -ip 3672
1⤵
PID:2404

lac_log.txt

Path C:\Users\Admin\AppData\Local\Temp\lac_log.txt
Size 1KB
SHA256 34262364e2d9ae776913694200e3350409086df2a952ca51c996913c07b3582a
MD5 2eb73a0cf685ff115fa70aea68817997
SHA1 28e4b207e63b4526db39a67804410ddf3bab688c
SHA512 be3ec9e4394af0af111ae3df198ef1ced6d4c963b8b88bda46450454331dc8624bd45312b0785637b3d7a1e1f362f0931b129cc85ecf4a42f865e7733903c12d
MD5 SHA1 SHA512

Submit Download

memory/3672-0-0x0000000010000000-0x0000000010010000-memory.dmp

Download

memory/3672-50-0x00000000774F2000-0x00000000774F3000-memory.dmp

Download

memory/3672-53-0x0000000010000000-0x0000000010010000-memory.dmp

Download