dc2f891d87dc2965a6484c3b46282a26f8bc4f9317a913ea24c2d007a9b9ee56

Analysis

max time kernel
155s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 11:00

Target

460f1a2f557a32210ba108c745a29a41.dll
Size

60KB
MD5

460f1a2f557a32210ba108c745a29a41
SHA1

a1d2b59ec54f100566cfabd7a5631576554beeab
SHA256

dc2f891d87dc2965a6484c3b46282a26f8bc4f9317a913ea24c2d007a9b9ee56
SHA512

7d7f480d381a51d928f6178ace9e282836ef702fe4181a4c2a07ab1da3ca367715d235549beaa9aa2b8301698dd5f59daaa1633149a1e50d0eb8cd117430646c
SSDEEP

768:BnnQ9cLLQiuwlGs4b/kSMAOccGPTVv3Jxy4k+H5aDzeI0xhZaCH5m8B:u2LzVGs0kSMDczPTVvZxBZCKDV5m

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1616	3996	WerFault.exe	90
4220	3996	WerFault.exe	90

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3996	4476	rundll32.exe	90
PID 4476 wrote to memory of 3996	4476	rundll32.exe	90
PID 4476 wrote to memory of 3996	4476	rundll32.exe	90
PID 3996 wrote to memory of 1616	3996	rundll32.exe	96
PID 3996 wrote to memory of 1616	3996	rundll32.exe	96
PID 3996 wrote to memory of 1616	3996	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\460f1a2f557a32210ba108c745a29a41.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\460f1a2f557a32210ba108c745a29a41.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 600
    3⤵
    - Program crash
    PID:1616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 600
    3⤵
    - Program crash
    PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3996 -ip 3996
1⤵
PID:4164