6f49f878497552d4f0db7dce6279c809b886f53f9458f74efdb379a813544172

Analysis

max time kernel
151s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 12:53

Target

19226e1e3d045fec70e07a230580cdf5.dll
Size

17KB
MD5

19226e1e3d045fec70e07a230580cdf5
SHA1

991efda79b1684900329cd3ab12037283d9b2356
SHA256

6f49f878497552d4f0db7dce6279c809b886f53f9458f74efdb379a813544172
SHA512

e6be254b4b4c9b43c5c4a3333cf494e1c520001e65baeb0e97f00dfaf331bf9035faec0424bb0d1dcfa37703040b69da8351cca8ae483f3b3f331277abfc32bb
SSDEEP

384:0fpZZE/zUAkyM1MpEYjiYqZtEXixOC0wiUWvEGmmEWAuePlrKWcH85H:0BeNfpEYxqPEXkWP4DuArbu85

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4356	1524	WerFault.exe	41

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 1524	3504	rundll32.exe	41
PID 3504 wrote to memory of 1524	3504	rundll32.exe	41
PID 3504 wrote to memory of 1524	3504	rundll32.exe	41

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19226e1e3d045fec70e07a230580cdf5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\19226e1e3d045fec70e07a230580cdf5.dll,#1
  2⤵
  PID:1524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 560
    3⤵
    - Program crash
    PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1524 -ip 1524
1⤵
PID:4068

memory/1524-0-0x00000000755A0000-0x00000000755AF000-memory.dmp

Filesize
60KB

Download
memory/1524-1-0x00000000755A0000-0x00000000755AF000-memory.dmp

Filesize
60KB

Download
memory/1524-2-0x00000000755A0000-0x00000000755AF000-memory.dmp

Filesize
60KB

Download