df6a7e61058d35963f2bc28a612eeda7a77cfd8cc5ca0a45a93e283bf97e1343

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:43

Target

28a9e9e996057378d14bd27ea5a9b2b5.dll
Size

19KB
MD5

28a9e9e996057378d14bd27ea5a9b2b5
SHA1

c8d0e31eaf78daf366c188ec21c0bcc3a629cc45
SHA256

df6a7e61058d35963f2bc28a612eeda7a77cfd8cc5ca0a45a93e283bf97e1343
SHA512

fdd72a9566d954085591e7fbd7c2a7ca69c7f7d150687019e19ee28ba079eee218a9623a340592c57add53d3226bf85554ef78166b224cd6fd567b4fb819ab1d
SSDEEP

384:3drkeqcgD131LO+LAAxrbH5dZPfGwip8sPa8ESaMOcuRyDdoo0uCcDK3dzTy7Mq1:tGDZZfZqj0cLJ8y7Lkc233MmoN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1480	2524	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2524	2072	rundll32.exe	16
PID 2072 wrote to memory of 2524	2072	rundll32.exe	16
PID 2072 wrote to memory of 2524	2072	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28a9e9e996057378d14bd27ea5a9b2b5.dll,#1
1⤵
PID:2524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 960
  2⤵
  - Program crash
  PID:1480

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28a9e9e996057378d14bd27ea5a9b2b5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2524 -ip 2524
1⤵
PID:4676