15d026ade9c9f7bfdcd45ab04e574c416d34b3d6833a502e23339974f592ac8e

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 13:17

Target

3e9612ddc5888fff208ac5a434305796.dll
Size

50KB
MD5

3e9612ddc5888fff208ac5a434305796
SHA1

31d936ab245859013bd17f87530c8feb41aff1c4
SHA256

15d026ade9c9f7bfdcd45ab04e574c416d34b3d6833a502e23339974f592ac8e
SHA512

f09d8258a555ad3135b3b0b9fb1dafecb83d36d8f304c5413b0e9f7671077b533891971e35dc44d4be9a1b79d97c3999e120c224b7660f99626ebb79779f6dd2
SSDEEP

768:BS7MqklszD1jD95No51mV+sFuXE+PPvWR+CT+yr8t8MPOsYvwTqXaLfAN:Y7MqklsXzX+sFwWR+wQt8fpXaLf6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2732	1896	WerFault.exe	58

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 1896	1012	rundll32.exe	58
PID 1012 wrote to memory of 1896	1012	rundll32.exe	58
PID 1012 wrote to memory of 1896	1012	rundll32.exe	58

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e9612ddc5888fff208ac5a434305796.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e9612ddc5888fff208ac5a434305796.dll,#1
  2⤵
  PID:1896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 676
    3⤵
    - Program crash
    PID:2732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1896 -ip 1896
1⤵
PID:1900

memory/1896-0-0x0000000000620000-0x0000000000631000-memory.dmp

Filesize
68KB

Download
memory/1896-1-0x0000000000620000-0x0000000000631000-memory.dmp

Filesize
68KB

Download