9c2462dc30ae0453f715a5a14badc2aea79597ce4a94494b159ad14187fa6613

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 05:16

Target

4a88d1db50eb7ff5eceb056b82a36287.dll
Size

239KB
MD5

4a88d1db50eb7ff5eceb056b82a36287
SHA1

5e1727773822436e87dbf34b14129f8e7ddd450e
SHA256

9c2462dc30ae0453f715a5a14badc2aea79597ce4a94494b159ad14187fa6613
SHA512

d00f2a6438c0b7f39f81525409af09ffc2efb591279be30ba4d214eddcc05d66183b78518565cb61f32fdd36d1bab633d252c82eef4724647c3a1ae89c39f97d
SSDEEP

3072:d6ii7HfiBqspk2hMllwGQo2qPWG4fBHHvAsTt8M7yLPQQh41bslBUfDlxiGj9MhO:0BHfAuyMvwX4+iMGtzOSy8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2504	2828	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 2828	4740	rundll32.exe	90
PID 4740 wrote to memory of 2828	4740	rundll32.exe	90
PID 4740 wrote to memory of 2828	4740	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a88d1db50eb7ff5eceb056b82a36287.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a88d1db50eb7ff5eceb056b82a36287.dll,#1
  2⤵
  PID:2828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 660
    3⤵
    - Program crash
    PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2828 -ip 2828
1⤵
PID:4808

memory/2828-0-0x0000000000740000-0x0000000000781000-memory.dmp

Filesize
260KB

Download
memory/2828-1-0x0000000000740000-0x0000000000781000-memory.dmp

Filesize
260KB

Download