40bf8bbfd4a65ccef80ddbfde08db236c7f4e20e4e4f1431960a1f14005be734

Analysis

max time kernel
209s
max time network
235s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2024 18:19

Target

40bf8bbfd4a65ccef80ddbfde08db236c7f4e20e4e4f1431960a1f14005be734.dll
Size

1.2MB
MD5

5e58e058aba24c30be9eaff700de217f
SHA1

59e6d6de144dd596fda80cf32877bce518f9ed0b
SHA256

40bf8bbfd4a65ccef80ddbfde08db236c7f4e20e4e4f1431960a1f14005be734
SHA512

e15585f62d022f1be3cf762537e7903a7def247f73dc45bfc7779ade21d5913b8d23fd7c6330ee6f32a491ce9f39193b4c092e3b3fe7e23d159bdfd91ad8c1ad
SSDEEP

24576:lwOhCPykWGGrYL1hb4LPRAMXLXuw2tL0IGrkNBxgvx3FWlDe:9TKhL4LP+AMtBoAe

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 2012	4964	rundll32.exe	91
PID 4964 wrote to memory of 2012	4964	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40bf8bbfd4a65ccef80ddbfde08db236c7f4e20e4e4f1431960a1f14005be734.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4964 -s 328
  2⤵
  PID:2012