1647a017cf1d36a06831741e4cb6363902c6b5d8bf360afb004f07ca97c03d24

Analysis

max time kernel
156s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2024 17:09

Target

4c002e48fac2babcd9d33ec610cd57ac.dll
Size

6KB
MD5

4c002e48fac2babcd9d33ec610cd57ac
SHA1

3a281c746bebad85f2cc4ce6091414ca2aa0b54a
SHA256

1647a017cf1d36a06831741e4cb6363902c6b5d8bf360afb004f07ca97c03d24
SHA512

ad784d9988e18b194c32e358a00c14c20f0a6736009a9d2e1a3bfaf9f7a93e90755544e3ae33991deecf96abf28b73b170d165d403e6069de947c8e79ade987c
SSDEEP

96:LCpG1vSRhKilPiEsWLrx1ZywLvLw+EO3H/FEfDMZfJN8IfDP7:LCpGpSGlEsWLrx1NLvLVECH9EfDM1JN9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4552	1164	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 1164	3168	rundll32.exe	89
PID 3168 wrote to memory of 1164	3168	rundll32.exe	89
PID 3168 wrote to memory of 1164	3168	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c002e48fac2babcd9d33ec610cd57ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c002e48fac2babcd9d33ec610cd57ac.dll,#1
  2⤵
  PID:1164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 620
    3⤵
    - Program crash
    PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1164 -ip 1164
1⤵
PID:1508