33ebb0de9437f8efe1b22652ef9fb5137dc371c30e06e55702406fd002c31b7a

Analysis

max time kernel
168s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:36

Target

2a3fa4a22d4324bb16be7f638c364699.dll
Size

44KB
MD5

2a3fa4a22d4324bb16be7f638c364699
SHA1

5b2fa7972fb49e921fa66f043fdf3fc35d7ee9c4
SHA256

33ebb0de9437f8efe1b22652ef9fb5137dc371c30e06e55702406fd002c31b7a
SHA512

bd8085c4736099c915d168806a3b128f7bd50f741d1c1b630c02963c0426c5ab5416edef75ab20b4604dd0fe714534ffdc0b12be056f70a3eeb20c0e45837ed1
SSDEEP

384:qxWUGpuuxL8WtTTnFo//EEXeudtLmJItHr3hMNmqGm77yhlo1L5Eu8jHJ7tu:nuuSWtTzFKXbmJIfMNWmfoo1L5Ef

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4904	1680	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1680	1172	rundll32.exe	89
PID 1172 wrote to memory of 1680	1172	rundll32.exe	89
PID 1172 wrote to memory of 1680	1172	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a3fa4a22d4324bb16be7f638c364699.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a3fa4a22d4324bb16be7f638c364699.dll,#1
  2⤵
  PID:1680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 568
    3⤵
    - Program crash
    PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1680 -ip 1680
1⤵
PID:1880