9a6b8921a9d015f0d9d5787b6c5deea2aaec7102a2069ea1b31698da91bb5c49

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 10:51

Target

3c5bb8b12a65098b81b0bfa93b32739f.dll
Size

188KB
MD5

3c5bb8b12a65098b81b0bfa93b32739f
SHA1

ea6784b62ff77fe1b63ea7c3e770d4d1b82cbac2
SHA256

9a6b8921a9d015f0d9d5787b6c5deea2aaec7102a2069ea1b31698da91bb5c49
SHA512

ee95d8d988fb6e166fe32aa029f98df17aa6f33b8a13894502a0baa267943a9a4d10ffb8ff30dc45bcd5d8d364649a6fe9105fc28a6edb82e9fbf360d41d68c9
SSDEEP

3072:UA8JmK7ATVfQeVqNFZa/9KzMXJ6jTFDlAwqWut5KZMzfeAAAo/o:UzIqATVfQeV2FZalKq6jtGJWuTmd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3888	1816	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1816	1788	rundll32.exe	14
PID 1788 wrote to memory of 1816	1788	rundll32.exe	14
PID 1788 wrote to memory of 1816	1788	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c5bb8b12a65098b81b0bfa93b32739f.dll,#1
1⤵
PID:1816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 664
  2⤵
  - Program crash
  PID:3888

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c5bb8b12a65098b81b0bfa93b32739f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1816 -ip 1816
1⤵
PID:3096

memory/1816-0-0x0000000075480000-0x00000000754B0000-memory.dmp

Filesize
192KB

Download
memory/1816-1-0x00000000009F0000-0x00000000009F6000-memory.dmp

Filesize
24KB

Download