c64b1dc11f31523760a137f9fab09712af8fee3bf8197ef511b2b7b993625484

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 00:04

Target

4782d7988956561999d5944a3cac945d.dll
Size

56KB
MD5

4782d7988956561999d5944a3cac945d
SHA1

7df5911718e50ababbded3a1d1a412b5caa7f97d
SHA256

c64b1dc11f31523760a137f9fab09712af8fee3bf8197ef511b2b7b993625484
SHA512

bc17cb69ca9015fe38f5465157cac0f9faebeed1da6649a39729eff6590a2ec4a0ec8f403e969a05886813a6ca33328f999ffe7cc535a7353a5d2afa018ab9ce
SSDEEP

768:hSjq0Qn1wNGdYFxs9dNS9hxVP4AYhT85J+PSV0Jgz9hdm9oai8JrkttaS20QzC:4jq0QnqUEjQAY2V8gz92FOV25C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1376	2984	WerFault.exe	62

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 2984	3752	rundll32.exe	62
PID 3752 wrote to memory of 2984	3752	rundll32.exe	62
PID 3752 wrote to memory of 2984	3752	rundll32.exe	62

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4782d7988956561999d5944a3cac945d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4782d7988956561999d5944a3cac945d.dll,#1
  2⤵
  PID:2984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 612
    3⤵
    - Program crash
    PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2984 -ip 2984
1⤵
PID:3724

memory/2984-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download