6ce49155403f37a5c7808e0f4526d8ad43dd250b8278a79d7c21af790add66fc

Analysis

max time kernel
152s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 06:03

Target

2b148779aad21dfd3837686ff9997787.dll
Size

89KB
MD5

2b148779aad21dfd3837686ff9997787
SHA1

91e482ec6b60358b13db280786bf37bd37c613dc
SHA256

6ce49155403f37a5c7808e0f4526d8ad43dd250b8278a79d7c21af790add66fc
SHA512

0537fbda164ea98d72844e40cc9fb8359663c2844c7054b523ead477b24590bd0e3111a352e5d42ec0533a2e1f8e73ff15d3b776ef1848613a60b1da2eed60f2
SSDEEP

1536:4PjZQ3xawGfOcnJa8885z4BjucXrfHjx74Ew:4j8IwFWJaRc0Bljx74Ew

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1244	4656	WerFault.exe	18
3888	4656	WerFault.exe	18

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 4656	2360	rundll32.exe	18
PID 2360 wrote to memory of 4656	2360	rundll32.exe	18
PID 2360 wrote to memory of 4656	2360	rundll32.exe	18
PID 4656 wrote to memory of 1244	4656	rundll32.exe	93
PID 4656 wrote to memory of 1244	4656	rundll32.exe	93
PID 4656 wrote to memory of 1244	4656	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b148779aad21dfd3837686ff9997787.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b148779aad21dfd3837686ff9997787.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 716
    3⤵
    - Program crash
    PID:1244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 716
    3⤵
    - Program crash
    PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4656 -ip 4656
1⤵
PID:4876