74ad5c06560a71faa2af226c95468480845a04af8dd1bde6cefb641cfde72ae0

Analysis

max time kernel
145s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 14:15

Target

39732f89c537c930a7473cdd3139f451.dll
Size

71KB
MD5

39732f89c537c930a7473cdd3139f451
SHA1

e4cb3bb0036511bc28c9626e692d498498da1b01
SHA256

74ad5c06560a71faa2af226c95468480845a04af8dd1bde6cefb641cfde72ae0
SHA512

267af967385dbedd80f67b472bed2a53348ee894424d4576ad4cf90bee4e73d2cf192c66d66ef3f495d98d39bb04d338a1a264cce0fe7368ff180f463eaae8ed
SSDEEP

1536:n+ukDMfPy3Pzm46jqD2lJfcJ2enJI9BC/z4toaf1000:+uiv3s+2gMeO9k/zcf1n0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
4672	3348	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 3348	4516	rundll32.exe	21
PID 4516 wrote to memory of 3348	4516	rundll32.exe	21
PID 4516 wrote to memory of 3348	4516	rundll32.exe	21

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3348 -ip 3348
1⤵
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 572
1⤵
- Program crash
PID:4672

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39732f89c537c930a7473cdd3139f451.dll,#1
1⤵
PID:3348

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39732f89c537c930a7473cdd3139f451.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4516

memory/3348-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download