050a0fbb6d2fd755d95fc0e898d4a6645a90d9559d5b9818cf9ead236dc2ab74

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 07:55

Target

050a0fbb6d2fd755d95fc0e898d4a6645a90d9559d5b9818cf9ead236dc2ab74.dll
Size

2.2MB
MD5

228ea3aaee9f6278223df4507a334ee7
SHA1

2534790987ea64be200139f55fcaa7ad4b97ebf8
SHA256

050a0fbb6d2fd755d95fc0e898d4a6645a90d9559d5b9818cf9ead236dc2ab74
SHA512

e84c4d5eab326d42dd5fe9fe39bdc21b8bfe28c3313ee4401899fd2ef29fffce6dfc393da05ce4df0fdc0bd4b145321445af0d37a86d3bd9b3c2740183a5600c
SSDEEP

49152:TJd0OM5Fym/8eJ6YM97tQjFozL19wNa/Wgn:VCOM56eJvjFKp9JWgn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5008	3108	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 3108	3792	rundll32.exe	91
PID 3792 wrote to memory of 3108	3792	rundll32.exe	91
PID 3792 wrote to memory of 3108	3792	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\050a0fbb6d2fd755d95fc0e898d4a6645a90d9559d5b9818cf9ead236dc2ab74.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\050a0fbb6d2fd755d95fc0e898d4a6645a90d9559d5b9818cf9ead236dc2ab74.dll,#1
  2⤵
  PID:3108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 560
    3⤵
    - Program crash
    PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3108 -ip 3108
1⤵
PID:3816