c8aa597ae578588a9d7b4833a9c7cdcbf7cbd0de14cecbd44789aadbdff92e6b

Analysis

max time kernel
156s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 14:45

Target

4943ea620a12a2b8b8ff7e408e7e5765.dll
Size

19KB
MD5

4943ea620a12a2b8b8ff7e408e7e5765
SHA1

c5a3c5196b19d1434ef154637ed80564d005a33b
SHA256

c8aa597ae578588a9d7b4833a9c7cdcbf7cbd0de14cecbd44789aadbdff92e6b
SHA512

e649b24d836598b2b627de6e14ff246b6c6e4c3471d94fcd014f203abbd7b78c5f84cbdf765c0613057b9d9aec5662b963b6f871450b8b326eae610bc619ed2c
SSDEEP

384:yJPygyixKwKDUc9eWAJjQHGLEi3M6A1s5fRMMdM9BjKWQaaV++dULJricVVo6Mk:EP8mMN1JMaNQaawt1icVVoH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3572	3208	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 3208	3232	rundll32.exe	90
PID 3232 wrote to memory of 3208	3232	rundll32.exe	90
PID 3232 wrote to memory of 3208	3232	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4943ea620a12a2b8b8ff7e408e7e5765.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4943ea620a12a2b8b8ff7e408e7e5765.dll,#1
  2⤵
  PID:3208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 632
    3⤵
    - Program crash
    PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3208 -ip 3208
1⤵
PID:440