22f2490834e91c577c90c19bbf78d588c9b7c70a59a2b316c3ec4ab3bd7d2e92

Analysis

max time kernel
122s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 03:41

Target
9a80eb8aea03ed2b2306b53cb06542e8cae92b40008851bcc7d3eff62944c5b9.dll
Size 1.0MB
Sample240108-d8vknaaear
SHA256 9a80eb8aea03ed2b2306b53cb06542e8cae92b40008851bcc7d3eff62944c5b9
MD5 c376ae442a615dcf2f4a0fc4aa2e0de9
SHA1 a592872d7d5931dbd9fa260f54198820b76ef81c
SHA512 d8d71261257355023786865bf10c5aad464c6b415de74ed6c7b1309766da5c5fe629a52e85522bf7da96d3126ba8df5f94ad485cd628f5fb63fef3999c91f80e
SSDEEP 24576:aXRdzjw14xCWQuVsEDQbz27jhVS2wP+DBT8+u6p:s3/2zAjhG4T33
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4436	1100	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1100	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 1100	2840	rundll32.exe	89
PID 2840 wrote to memory of 1100	2840	rundll32.exe	89
PID 2840 wrote to memory of 1100	2840	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a80eb8aea03ed2b2306b53cb06542e8cae92b40008851bcc7d3eff62944c5b9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a80eb8aea03ed2b2306b53cb06542e8cae92b40008851bcc7d3eff62944c5b9.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 648
    3⤵
    - Program crash
    PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1100 -ip 1100
1⤵
PID:2284

memory/1100-0-0x0000000000400000-0x000000000050F000-memory.dmp

Download