49ecf0612dcd08a087dfbfc5f9e2aed8ed691b008a31fcb15f32c60679f44294

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 19:09

Target

4437a98ea3a031b117b10713d655f0a6.dll
Size

381KB
MD5

4437a98ea3a031b117b10713d655f0a6
SHA1

0b0de2f9a611df1c5521c8f9307a38e78b709f31
SHA256

49ecf0612dcd08a087dfbfc5f9e2aed8ed691b008a31fcb15f32c60679f44294
SHA512

5b7bade7917b476eaec512ecdadf57a7aa86939896c8223f8d823d6b1129a03c4bf5c85b67b90d620033481fcd90ca6917a5c27f76d2ba6e4ef47feed1d07577
SSDEEP

6144:r01jO5YfX7OP+oZVmvByhbJqU5Tv0gsO0t8Sh7Aj09uAzxBRWN5WT8gT:YjOqfSPNVmpyhDd8gr0TtAj09LzbRE5K

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1132	3664	WerFault.exe	33

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 3664	264	rundll32.exe	33
PID 264 wrote to memory of 3664	264	rundll32.exe	33
PID 264 wrote to memory of 3664	264	rundll32.exe	33

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4437a98ea3a031b117b10713d655f0a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4437a98ea3a031b117b10713d655f0a6.dll,#1
  2⤵
  PID:3664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 580
    3⤵
    - Program crash
    PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3664 -ip 3664
1⤵
PID:4660