cb84989e7f2e41ccfe682d8e3926700fed0713ae6d3dff904a523786777778a4

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 00:33

Target

3b761bff632f09fd83d85d139aab7d0e.dll
Size

83KB
MD5

3b761bff632f09fd83d85d139aab7d0e
SHA1

46504507efb128233781a820c08ab681fedd6fa7
SHA256

cb84989e7f2e41ccfe682d8e3926700fed0713ae6d3dff904a523786777778a4
SHA512

5e46bcb957cfa66f6452f2394b8a6f49e7b68b663116df6b621896f9d98173481efce6a92d2b63b9ed00e44b3661854c873faae5cbec9db1315293441eb9c413
SSDEEP

1536:k/vI1FLboSyo9yZrZVfYyERyzLtnipMrmD/lLq9pqk6wtfy/PZ7s:k/v8o69WrZG0Bni1hEGw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
436	2460	WerFault.exe	66

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 2460	908	rundll32.exe	66
PID 908 wrote to memory of 2460	908	rundll32.exe	66
PID 908 wrote to memory of 2460	908	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b761bff632f09fd83d85d139aab7d0e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b761bff632f09fd83d85d139aab7d0e.dll,#1
  2⤵
  PID:2460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 544
    3⤵
    - Program crash
    PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2460 -ip 2460
1⤵
PID:1092

memory/2460-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download