a3553d09a2a47b97ff56355f70eb6b058a94a4902b9f23be9170581a9c1b08fd

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 04:14

Target

4540ff56df64146698f31bd307799430.dll
Size

76KB
MD5

4540ff56df64146698f31bd307799430
SHA1

e069b02f3c65e99ef74968eb2737c23bc31afbc3
SHA256

a3553d09a2a47b97ff56355f70eb6b058a94a4902b9f23be9170581a9c1b08fd
SHA512

7933c7b5ccb2ab97c69e243d186ec542b8420773657330e2fabf9eba80de3f3e7660232e0d92b061ef6112c80e34c9b1eb1c5cfe5f29aed7584fced43620fbfe
SSDEEP

768:1WbVDHu1hvkOSFQN8EZhH+IwiaeTM0tQ14cTNW4iiNqAZzhDUv+hcTT:wbhHKdWQGLeTJtQ1/NW4iiXURT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	3548	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 3548	2340	rundll32.exe	18
PID 2340 wrote to memory of 3548	2340	rundll32.exe	18
PID 2340 wrote to memory of 3548	2340	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4540ff56df64146698f31bd307799430.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4540ff56df64146698f31bd307799430.dll,#1
  2⤵
  PID:3548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 640
    3⤵
    - Program crash
    PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3548 -ip 3548
1⤵
PID:1580