9aa078ca05990433cf6ce3d6ffd737b65f2594664470b7d29b5d3e2c2c26cfd0

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 06:10

Target

4017e8b8761e644217ca01996a000f75.dll
Size

92KB
MD5

4017e8b8761e644217ca01996a000f75
SHA1

d73eb539b3db5860dcf55ee93d578a5e6d6efdbf
SHA256

9aa078ca05990433cf6ce3d6ffd737b65f2594664470b7d29b5d3e2c2c26cfd0
SHA512

f207e375df3fc6ebaac99a8bc9659cef2a840de3cbba5dc2b899e140a4c3e8e60870e8195cbbe03c105c980581758fcc6cc2fe8727156651bf7d8848af38f421
SSDEEP

1536:TkBTwtqyd5xrXYbcGnPYGVdqw0eEl7bepBRi3WAycLLqLOnpoJp+yVUFAnJE:TrAYVOee8bGBoyuLqP0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4312	4420	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 4420	2112	rundll32.exe	87
PID 2112 wrote to memory of 4420	2112	rundll32.exe	87
PID 2112 wrote to memory of 4420	2112	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4017e8b8761e644217ca01996a000f75.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4017e8b8761e644217ca01996a000f75.dll,#1
  2⤵
  PID:4420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 544
    3⤵
    - Program crash
    PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4420 -ip 4420
1⤵
PID:1952

memory/4420-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download