7f8643c5fd9c8197980822809b3ecb7348b4c15aa329d5f6d72fcf91eb1168c3

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 11:50

Target

17931cf21108a3cae32e15cc0d8a6bbc.dll
Size

216KB
MD5

17931cf21108a3cae32e15cc0d8a6bbc
SHA1

8e9a7d5e67e647c68818e19419d9bcb9eeb6f4e0
SHA256

7f8643c5fd9c8197980822809b3ecb7348b4c15aa329d5f6d72fcf91eb1168c3
SHA512

a37637fe5e3f1a265a0de912732c4d05040f53cfde9685061d38417023378f8afebc02ed139a5c620b09ba3da4dbee0dc5f8e2c6b7ed395f186b5db6e8a82011
SSDEEP

3072:H3rGu1ajTqVh7VnNlnprh1XNbacguTDinrpb/9c7pciz/ohUgu:uqVh7n1vURlc6iz2U3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
428	3180	WerFault.exe	13

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 3180	1756	rundll32.exe	13
PID 1756 wrote to memory of 3180	1756	rundll32.exe	13
PID 1756 wrote to memory of 3180	1756	rundll32.exe	13

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17931cf21108a3cae32e15cc0d8a6bbc.dll,#1
1⤵
PID:3180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 556
  2⤵
  - Program crash
  PID:428

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17931cf21108a3cae32e15cc0d8a6bbc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3180 -ip 3180
1⤵
PID:1564

memory/3180-0-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Filesize
4KB

Download