53cfb6c56a22e9a79166058b9adf9ed9a88fc2f0b214988d0f4888114a32bcfa

Analysis

max time kernel
135s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:39

Target
2a55cd1e5e5c5791c896a48ea40e2ee3.dll
Size 103KB
Sample231231-gcclraffbj
SHA256 53cfb6c56a22e9a79166058b9adf9ed9a88fc2f0b214988d0f4888114a32bcfa
MD5 2a55cd1e5e5c5791c896a48ea40e2ee3
SHA1 a556db18342cc64b04d6b7fed038d3f9d43f80f9
SHA512 bec8cc12a54bf0195b28c192e4e7a1c80311153c2eddba230dad0ee6bc09c29e23f15b46cae504f3488771add9aa228f328535e223bc34b5140699bccd8703c1
SSDEEP 1536:m1qOQh1zLToT5lEaPUi80Agrj2f3ESRSMvr2t3ymo4QgQTQ1Ss:SwzLkTs6ju3ESRSMv6JJuEcs
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
492	3764	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 3764	2312	rundll32.exe	18
PID 2312 wrote to memory of 3764	2312	rundll32.exe	18
PID 2312 wrote to memory of 3764	2312	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a55cd1e5e5c5791c896a48ea40e2ee3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a55cd1e5e5c5791c896a48ea40e2ee3.dll,#1
  2⤵
  PID:3764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 580
    3⤵
    - Program crash
    PID:492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3764 -ip 3764
1⤵
PID:2140