3be4ec0c0b3a209f19208f2a27865a92352a4ccd69e07350cc8027a88d97ed95

Analysis

max time kernel
138s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 15:10

Target

3eb216d2ebf01ac8023989c46ae1a77b.dll
Size

185KB
MD5

3eb216d2ebf01ac8023989c46ae1a77b
SHA1

a2894b32ce95ddde399f839fbaf1a77876de321b
SHA256

3be4ec0c0b3a209f19208f2a27865a92352a4ccd69e07350cc8027a88d97ed95
SHA512

1d992be9321b13962a3077ea254a1031fbdbd5678e734c5c2ea8f5073170d961873fa6af39761435631fdff54bb0436878c287faee35e865b535d64b93e8d5ee
SSDEEP

3072:hzZFhBECT5NsBY7rhGya9wmpCs3rfbTTBftoNA5nQwbQoNsBY7rhGm:phBEClSBY/hGhWIrDTTBloNA5ngoSBYx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	2232	WerFault.exe	21

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 2232	3088	rundll32.exe	21
PID 3088 wrote to memory of 2232	3088	rundll32.exe	21
PID 3088 wrote to memory of 2232	3088	rundll32.exe	21

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eb216d2ebf01ac8023989c46ae1a77b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eb216d2ebf01ac8023989c46ae1a77b.dll,#1
  2⤵
  PID:2232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 652
    3⤵
    - Program crash
    PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2232 -ip 2232
1⤵
PID:3128