ad4f7bd47531807346c5b65fcafeb5bf9079343e3f507b0084444fdb9ee6a623

Analysis

max time kernel
147s
max time network
223s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 03:57

Target

27297401f0f69aa664c1318ea0edae3d.dll
Size

47KB
MD5

27297401f0f69aa664c1318ea0edae3d
SHA1

cb604229d900706ebcd37a47e231e49dbae4be2b
SHA256

ad4f7bd47531807346c5b65fcafeb5bf9079343e3f507b0084444fdb9ee6a623
SHA512

a227c90d37a9621b53e02a930591facfd7e6ff516a6ce00a9f7d7985b62c1540910857c14c6fd06f76c14c5b34af1cd55b64d408dce5dbba37d32ecbaa13e994
SSDEEP

384:7nheRp/tLuI4IiZSQZxYYoYw6sjFYooBMpOiPtuPGB4mVBZ:7hSXLuIFipo/FurmJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4264	1676	WerFault.exe	92

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1676	2084	rundll32.exe	92
PID 2084 wrote to memory of 1676	2084	rundll32.exe	92
PID 2084 wrote to memory of 1676	2084	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27297401f0f69aa664c1318ea0edae3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27297401f0f69aa664c1318ea0edae3d.dll,#1
  2⤵
  PID:1676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 548
    3⤵
    - Program crash
    PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1676 -ip 1676
1⤵
PID:5100

memory/1676-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download