9ebeef8be72c8139ac8483c5af83f898bdc19584c6225dd78b607c9fea214927

Analysis

max time kernel
141s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 11:40

Target

175f51a9573591fcef1cfe86c8c56e9a.dll
Size

23KB
MD5

175f51a9573591fcef1cfe86c8c56e9a
SHA1

a82e7fccd674e8892eaf91438de901b6eadbee09
SHA256

9ebeef8be72c8139ac8483c5af83f898bdc19584c6225dd78b607c9fea214927
SHA512

43c69f29c6f3fba9c650b9f04f9997cd528ef24901961d7a9e392b8a3e0f93afe7017da5165521b61c0d6e27c4734f2af6125366c27bb51c2b5a2befab04ef98
SSDEEP

384:WQntQXrGSn3ksp+GFHRKTsWkPBB9IFVTHqxkHe69RN3lJubQB36gsIoic2c:FM7n3ksphbNBeFVTHEyRvJubiqg/p

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4896	3672	WerFault.exe	77
4704	3672	WerFault.exe	77
448	3672	WerFault.exe	77

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 3672	3720	rundll32.exe	77
PID 3720 wrote to memory of 3672	3720	rundll32.exe	77
PID 3720 wrote to memory of 3672	3720	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\175f51a9573591fcef1cfe86c8c56e9a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\175f51a9573591fcef1cfe86c8c56e9a.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 196
    3⤵
    - Program crash
    PID:4896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 676
    3⤵
    - Program crash
    PID:4704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 656
    3⤵
    - Program crash
    PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3672 -ip 3672
1⤵
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3672 -ip 3672
1⤵
PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3672 -ip 3672
1⤵
PID:2404

C:\Users\Admin\AppData\Local\Temp\lac_log.txt

Filesize
1KB

MD5
2eb73a0cf685ff115fa70aea68817997

SHA1
28e4b207e63b4526db39a67804410ddf3bab688c

SHA256
34262364e2d9ae776913694200e3350409086df2a952ca51c996913c07b3582a

SHA512
be3ec9e4394af0af111ae3df198ef1ced6d4c963b8b88bda46450454331dc8624bd45312b0785637b3d7a1e1f362f0931b129cc85ecf4a42f865e7733903c12d

Download Submit
memory/3672-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/3672-50-0x00000000774F2000-0x00000000774F3000-memory.dmp

Filesize
4KB

Download
memory/3672-53-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download