cb661ec0d25c3456054f41af732e48440ac0c173f0e8e5bbc27000d90fd5af61

Analysis

max time kernel
114s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 13:43

Target

1a64a76a900932027263afffc1f96748.dll
Size

90KB
MD5

1a64a76a900932027263afffc1f96748
SHA1

79655073a28756fd3796a5e901cb536a17cc7d91
SHA256

cb661ec0d25c3456054f41af732e48440ac0c173f0e8e5bbc27000d90fd5af61
SHA512

31f9655279aa4f594b7101792a818e60e638748bb82d216bd6fb42d009e58b57729b0ed7c04b23b96b4cbaeb811112160f957755e7aa77332dcfd58a17019753
SSDEEP

768:1Xf/yDxA8rQprMkyXvmRHHXaAc/rjcQK/P7jtmGxWKQffPPQ5TSbe5b:tAA802ktRHHXaAmHc//PtWLaTS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
220	4816	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 4816	3700	rundll32.exe	14
PID 3700 wrote to memory of 4816	3700	rundll32.exe	14
PID 3700 wrote to memory of 4816	3700	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a64a76a900932027263afffc1f96748.dll,#1
1⤵
PID:4816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 548
  2⤵
  - Program crash
  PID:220

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a64a76a900932027263afffc1f96748.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4816 -ip 4816
1⤵
PID:1680

memory/4816-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download