ae3c145040737925c247c361d40f6b61edfdd7e601b450a59035963495db7bc5

Analysis

max time kernel
152s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 01:31

Target

22ed00cd49f6643feb009fdd5a4f10f3.dll
Size

29KB
MD5

22ed00cd49f6643feb009fdd5a4f10f3
SHA1

9f9e1d8e08d26c2442c7309332dfc52a2742c122
SHA256

ae3c145040737925c247c361d40f6b61edfdd7e601b450a59035963495db7bc5
SHA512

00ce6797e1ac73ccd0f10e56e223a38b9d1c4e5b738c589cc32b56393b93de1ea6e581814dce96f11f4fb607fe278fa3d5a477f74475045477da2b9880fc3461
SSDEEP

384:WUnMA6iQCr+/I7KmicVzOKadirT5RJgg8HrqehZ57Gci/mO2utbh1iRw5Jp4nI7:NMTiLrX6cVOKauT5oPrtKmO29UJWc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3872	4936	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 4936	3180	rundll32.exe	88
PID 3180 wrote to memory of 4936	3180	rundll32.exe	88
PID 3180 wrote to memory of 4936	3180	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22ed00cd49f6643feb009fdd5a4f10f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22ed00cd49f6643feb009fdd5a4f10f3.dll,#1
  2⤵
  PID:4936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 544
    3⤵
    - Program crash
    PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4936 -ip 4936
1⤵
PID:2124

memory/4936-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download