476eed7a65001bdb3e91da3b98f0c45705dce5772ce8cf899fd02db61673df1c

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 02:55

Target

255960ef43f7473e0ce7a5e2e845b0b6.dll
Size

868KB
MD5

255960ef43f7473e0ce7a5e2e845b0b6
SHA1

dbc68bcd33eef506efbd6290e040da4011797b86
SHA256

476eed7a65001bdb3e91da3b98f0c45705dce5772ce8cf899fd02db61673df1c
SHA512

f0884bb82f4746b6cc5d0fec21547aee80ecd421e444b6135cb4e157ffd8580d1cbd5100384dcddabf6d8c70cc1f5fd0b332a77ae0ff7a0c45a7bb7577f2c219
SSDEEP

3072:oLimbdgk+DG5RZTXFd+igW88T5fC+OeMLCbM3GWRybRFufYUMxYcwFhQUA9u:Wimb6WR9Xf+igWPfJbM3abRFsmjO

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2984	3796	WerFault.exe	91
3876	3796	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 3796	4100	rundll32.exe	91
PID 4100 wrote to memory of 3796	4100	rundll32.exe	91
PID 4100 wrote to memory of 3796	4100	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\255960ef43f7473e0ce7a5e2e845b0b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\255960ef43f7473e0ce7a5e2e845b0b6.dll,#1
  2⤵
  PID:3796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 560
    3⤵
    - Program crash
    PID:2984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 848
    3⤵
    - Program crash
    PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3796 -ip 3796
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3796 -ip 3796
1⤵
PID:2352