acef7f0681bedb4a635e4d4d2e97b4030d27cf36be76a5c4eb1f3f400368c92a

Analysis

max time kernel
150s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 03:54

Target

47f5352276783b2277f44ee167921d2f.dll
Size

44KB
MD5

47f5352276783b2277f44ee167921d2f
SHA1

7daa65c22ca98c277843968d4845f256437dc8b2
SHA256

acef7f0681bedb4a635e4d4d2e97b4030d27cf36be76a5c4eb1f3f400368c92a
SHA512

ec780ca50bf78084de03828b99814b26a870861541794038975181c7b638b40f3f36ec7b0ebb1bb0a1980f935af3901bd37f9cbbf09847baeed25e1aa87b6cce
SSDEEP

768:W+2/zx9VtqkFK4esvXFHQ+W2Rq4mbzhITRFI3WtC1:WZzDquKtEwZ2Rq4mfhITRFIp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4528	3700	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 3700	3708	rundll32.exe	89
PID 3708 wrote to memory of 3700	3708	rundll32.exe	89
PID 3708 wrote to memory of 3700	3708	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47f5352276783b2277f44ee167921d2f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47f5352276783b2277f44ee167921d2f.dll,#1
  2⤵
  PID:3700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 560
    3⤵
    - Program crash
    PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3700 -ip 3700
1⤵
PID:4784

memory/3700-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download