4d16f3254784df9f58caa7426c2fff115a6d66423239fd227583b9fdee2a28bd

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 13:49

Target

3eb2ba0ada6ace71ae02244d2a293bb7.dll
Size

236KB
MD5

3eb2ba0ada6ace71ae02244d2a293bb7
SHA1

706e4ebe772032636f8bff196c21cf357ea43ace
SHA256

4d16f3254784df9f58caa7426c2fff115a6d66423239fd227583b9fdee2a28bd
SHA512

d24912ae296614c030ada636b8984ca0382a558ffb28061ea1f4710b11511c5ebdb36fe82ce7a084faadda7c3509073f5b266fc0951b130a230773cd4ac4a19d
SSDEEP

1536:Pdy3Reso86ZHBP9UZP7U6HxKlWeScw6iBYCCamzXaIEBCqiiQMZ4DfKBal9Vmscv:PdqH69BPdGKMcwVB2aQXfm7SLSDoIh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3084	4200	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 4200	2108	rundll32.exe	14
PID 2108 wrote to memory of 4200	2108	rundll32.exe	14
PID 2108 wrote to memory of 4200	2108	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eb2ba0ada6ace71ae02244d2a293bb7.dll,#1
1⤵
PID:4200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 660
  2⤵
  - Program crash
  PID:3084

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eb2ba0ada6ace71ae02244d2a293bb7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4200 -ip 4200
1⤵
PID:2060