9c61a5a9ee42020d87d80a0591b1a7220d8f3552b5f553812a303b64b6c26452

Analysis

max time kernel
148s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 23:36

Target

477543cf2a46c3ba4717106acec212d5.dll
Size

227KB
MD5

477543cf2a46c3ba4717106acec212d5
SHA1

c8ac05a1413eaa8a85bc321886060ca9fe4273a5
SHA256

9c61a5a9ee42020d87d80a0591b1a7220d8f3552b5f553812a303b64b6c26452
SHA512

116b8747436ab96e28d21340903f5adb59770bb97deb026df524a1edde3816a9cbe2ff2799c7709e85eac11a7dcb3c3122c21858874b47f2d176d0c214a70dee
SSDEEP

6144:CHfM+oQ1Bv76X/lmXn2gkbUiLlzgBpPSYQktQwv:C001Bv7o4X7kjLVmlSYX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5008	1832	WerFault.exe	19

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1832	rundll32.exe
1832	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 1832	5064	rundll32.exe	19
PID 5064 wrote to memory of 1832	5064	rundll32.exe	19
PID 5064 wrote to memory of 1832	5064	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\477543cf2a46c3ba4717106acec212d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\477543cf2a46c3ba4717106acec212d5.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 688
    3⤵
    - Program crash
    PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1832 -ip 1832
1⤵
PID:1232

memory/1832-1-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/1832-2-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/1832-3-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/1832-0-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/1832-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download