b23db72e5c40f6386661864c529d93e120025cf62bd2c8ba021c8a073bb12504

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:00

Target

371442ea2ebd9abf02c1963d778498dd.dll
Size

99KB
MD5

371442ea2ebd9abf02c1963d778498dd
SHA1

a70c386a6921a293c485c02f0a081bfb007907fd
SHA256

b23db72e5c40f6386661864c529d93e120025cf62bd2c8ba021c8a073bb12504
SHA512

80542cc3ba69fafbe0387484f9a7c1eb4dbf93059769dddca6824af4059834de9f618f4713e05c14eda39c02fac5227b96006b802e219c0b216ead5f34e66736
SSDEEP

1536:PvJtA57M+JMNNfDIncEvxBvRoS8bkIWK4IRUGKlET6mpXk+jgL8xqXEw:PvJtA5AiSDIc+BvRoS8RrhKm+iJbqEw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4988	2740	WerFault.exe	19

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2740	2196	rundll32.exe	19
PID 2196 wrote to memory of 2740	2196	rundll32.exe	19
PID 2196 wrote to memory of 2740	2196	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\371442ea2ebd9abf02c1963d778498dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\371442ea2ebd9abf02c1963d778498dd.dll,#1
  2⤵
  PID:2740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 556
    3⤵
    - Program crash
    PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2740 -ip 2740
1⤵
PID:4160

memory/2740-0-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download