0d35f067f0a1e7d547980eb785e5c75bc572ace288a6206e28c54afcbd0a1661

Analysis

max time kernel
146s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 07:09

Target

2ccec3e7b79925c313b19b8c6526481f.dll
Size

44KB
MD5

2ccec3e7b79925c313b19b8c6526481f
SHA1

0b1562fce02c9692998203810e97be1f14501258
SHA256

0d35f067f0a1e7d547980eb785e5c75bc572ace288a6206e28c54afcbd0a1661
SHA512

1cf91350d89d79315c4b0421a1f40c7612a46400cb7a72bc5b4d8568b9a98bf40c4fa20262f375e4a616cef966a25ade74df2dbd709133470e4a3bd3852899f0
SSDEEP

768:5X6xm1/ByEk7clJejVgKn6mCHGvFjLfOsIriSHrkuSrdvD3nbJLR9lLpy/2QJ3:5Kxm1ZyEk4loVjn6mCH8xrsZHrh6D3FQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3292	3680	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3680	4600	rundll32.exe	14
PID 4600 wrote to memory of 3680	4600	rundll32.exe	14
PID 4600 wrote to memory of 3680	4600	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ccec3e7b79925c313b19b8c6526481f.dll,#1
1⤵
PID:3680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 544
  2⤵
  - Program crash
  PID:3292

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ccec3e7b79925c313b19b8c6526481f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3680 -ip 3680
1⤵
PID:4804

memory/3680-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download