79058dae484c6714a466d4d04407af5f789ba0c318093e1535444eaa0a38bbe3

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 06:08

Target

2b34967e6fd95c00f4ad8233fad0751c.dll
Size

89KB
MD5

2b34967e6fd95c00f4ad8233fad0751c
SHA1

cb922d9abde81094d37104aaa4c7873538e51a1a
SHA256

79058dae484c6714a466d4d04407af5f789ba0c318093e1535444eaa0a38bbe3
SHA512

b1b9338f4af49aab8366b8137a41c1f331b868ea34730d00e84f16df30da4e25e21133e60bbf2fee31e828bb85b110b8d49eb95c7e46b1a4d445fd9116f9eae2
SSDEEP

1536:81tI/vtdJMj6QEk1Azcv2hAfxnKWpjfpTAZmplsjxN2H:81uVdigmAzc2cxnK+fOZmpls9Nc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
940	3476	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 3476	3568	rundll32.exe	14
PID 3568 wrote to memory of 3476	3568	rundll32.exe	14
PID 3568 wrote to memory of 3476	3568	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b34967e6fd95c00f4ad8233fad0751c.dll,#1
1⤵
PID:3476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 652
  2⤵
  - Program crash
  PID:940

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b34967e6fd95c00f4ad8233fad0751c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3476 -ip 3476
1⤵
PID:3280