621602bbd3fd304ec010621054aa89239e94b1946df159d4bda2bb2e7fb99f7c

Analysis

max time kernel
147s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 11:44

Target

176ba5797f70977037070e5562242582.dll
Size

72KB
MD5

176ba5797f70977037070e5562242582
SHA1

51f644956c1854fcc41b058ec48553c794fc7f2c
SHA256

621602bbd3fd304ec010621054aa89239e94b1946df159d4bda2bb2e7fb99f7c
SHA512

eb444fa348506fd8d78503d31ea323d35f524c506737b9bd1e46e6066d24cdc705c079fb481f19efaf31fcaf1ac948c400b9de33550dd48cc7dc1bd9de1b961c
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
864	2116	WerFault.exe	88
3724	2116	WerFault.exe	88

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2116	1704	rundll32.exe	88
PID 1704 wrote to memory of 2116	1704	rundll32.exe	88
PID 1704 wrote to memory of 2116	1704	rundll32.exe	88
PID 2116 wrote to memory of 864	2116	rundll32.exe	93
PID 2116 wrote to memory of 864	2116	rundll32.exe	93
PID 2116 wrote to memory of 864	2116	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\176ba5797f70977037070e5562242582.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\176ba5797f70977037070e5562242582.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 600
    3⤵
    - Program crash
    PID:864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 600
    3⤵
    - Program crash
    PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2116 -ip 2116
1⤵
PID:4672