0e5125af2b34ade3dc1d7de62e476a64e56e73812f7dd9e00eef0642cf7720e4

Analysis

max time kernel
146s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 12:35

Target

18b02771d952837b308937d2b0ad8be0.dll
Size

88KB
MD5

18b02771d952837b308937d2b0ad8be0
SHA1

78b1394bd8163b5045b7d7a149e86d2c2a2d6c35
SHA256

0e5125af2b34ade3dc1d7de62e476a64e56e73812f7dd9e00eef0642cf7720e4
SHA512

d6e97df17e0be9224843af4434094b603d863c8c404263a1d20aa351f9a77967be520bc00b0430e99c4d151691a98ea63f3525a03f9f740b737d5ae026bcdae1
SSDEEP

1536:x8hodhmf9GpSkiEHkJMrjVnJiK8olqqNZHKx0XZZp+OM0v4VD:usmt45nJiUlvQOMU4VD

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1724	2948	WerFault.exe	16
4460	2948	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 2948	3088	rundll32.exe	16
PID 3088 wrote to memory of 2948	3088	rundll32.exe	16
PID 3088 wrote to memory of 2948	3088	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\18b02771d952837b308937d2b0ad8be0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\18b02771d952837b308937d2b0ad8be0.dll,#1
  2⤵
  PID:2948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 608
    3⤵
    - Program crash
    PID:1724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 568
    3⤵
    - Program crash
    PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2948 -ip 2948
1⤵
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2948 -ip 2948
1⤵
PID:2012

memory/2948-0-0x0000000010000000-0x0000000010053000-memory.dmp

Filesize
332KB

Download