8ee306ef87007741e1f51eff734a5ca11d1ee97578b871067a840e76e8afcde6

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:45

Target

388c12c4314421ab2f0f611fcdd6d652.dll
Size

248KB
MD5

388c12c4314421ab2f0f611fcdd6d652
SHA1

6ef90bf4cebb7732fed2a27e68c324f5ec2f68b4
SHA256

8ee306ef87007741e1f51eff734a5ca11d1ee97578b871067a840e76e8afcde6
SHA512

062e018d7d68b2a7b493a0e3d796112ca72c13083c9d84318e352caf6aef17d7470543fc2558596a418f42cf1bb6d66ac10eb68a53783ad9001fbabca1861bb1
SSDEEP

6144:ZMncNTOdWKhwPSvY7LkqLzHHufqECubk9tPhdIlSLDgy0HzcNFcNA2:ZqWWKwmHHunk9VhalSDq8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
852	4512	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 4512	3648	rundll32.exe	14
PID 3648 wrote to memory of 4512	3648	rundll32.exe	14
PID 3648 wrote to memory of 4512	3648	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\388c12c4314421ab2f0f611fcdd6d652.dll,#1
1⤵
PID:4512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 584
  2⤵
  - Program crash
  PID:852

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\388c12c4314421ab2f0f611fcdd6d652.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4512 -ip 4512
1⤵
PID:3148

memory/4512-0-0x0000000010000000-0x0000000010117000-memory.dmp

Filesize
1.1MB

Download