1c42078b4ce7eae95645af8de2ee032f01b69a7497d8dded77bf1153580a39c1

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 06:28

Target

48436b99f1c1b616c19699cb82d8239e.dll
Size

89KB
MD5

48436b99f1c1b616c19699cb82d8239e
SHA1

fada2644609f8eeb9dcd0f096c7ff6f9daa8d8a9
SHA256

1c42078b4ce7eae95645af8de2ee032f01b69a7497d8dded77bf1153580a39c1
SHA512

9101d361607e4a8f564101398c23f85c6f22c4342b9000617b1c1a3075f2891a1928bf18eaa0c0f47739c76b0727f5f07ab9dd010f50dee533f6a8eabf051463
SSDEEP

1536:0gAEncyBGC7CXwcDWQVrQV8mhEbN/YAwoENpac7yZ41Bg2eJi:xcOCfDWQM/uDGqceu1e2eE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1164	2564	WerFault.exe	35

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 2564	4500	rundll32.exe	35
PID 4500 wrote to memory of 2564	4500	rundll32.exe	35
PID 4500 wrote to memory of 2564	4500	rundll32.exe	35

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48436b99f1c1b616c19699cb82d8239e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48436b99f1c1b616c19699cb82d8239e.dll,#1
  2⤵
  PID:2564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 544
    3⤵
    - Program crash
    PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2564 -ip 2564
1⤵
PID:3264

memory/2564-0-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download