6c537622307b452c14d885bcc1243a846531b25951bb691377d3e7d8341a18f1

Analysis

max time kernel
144s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 06:51

Target

2c430ddd4cc6e7cb775b1d358e27d6da.dll
Size

192KB
MD5

2c430ddd4cc6e7cb775b1d358e27d6da
SHA1

fc2823bc8a85ac33e87287affd560bf7dbf4dc61
SHA256

6c537622307b452c14d885bcc1243a846531b25951bb691377d3e7d8341a18f1
SHA512

b860edeb802afb15aa82203eaf71848bf9a6eba715a82bf332c2c527d423cdbe50fd11b5448e43b5895b3a896423eaa022004f054ae9b32fdc4d0dbdba46b052
SSDEEP

3072:RcVVj+epLUWz9/TRb43A+lnub1jKZBNDEnC0T2VJrZDX9FBCjV2eBbFNJI/mQMK8:uVVj+4UWz9/TRb43A+lnub1jKZBNDEnL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2348	1880	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1880	1636	rundll32.exe	14
PID 1636 wrote to memory of 1880	1636	rundll32.exe	14
PID 1636 wrote to memory of 1880	1636	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c430ddd4cc6e7cb775b1d358e27d6da.dll,#1
1⤵
PID:1880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 616
  2⤵
  - Program crash
  PID:2348

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c430ddd4cc6e7cb775b1d358e27d6da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1880 -ip 1880
1⤵
PID:1152