e80b3a00f9be4f614d444905b8c547609d3e2dd9b7cdf9fbe90448d2a5a108d4

Analysis

max time kernel
146s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 21:18

Target

4c7a36f2002f575d8af200fe0ded3e08.dll
Size

103KB
MD5

4c7a36f2002f575d8af200fe0ded3e08
SHA1

6da0457aee1be95cdfb21d0cb0cef0d4ea42d9d3
SHA256

e80b3a00f9be4f614d444905b8c547609d3e2dd9b7cdf9fbe90448d2a5a108d4
SHA512

509dd39c6f68d5fdc3660db2f071b052d5fc2a0af83108c8b2895d08db3ed2d2ebfb56fd521058896c9bea7765c4fcd1ecae56e71a1c15f2789fd9caa2da1cf8
SSDEEP

1536:H6YI8orbPk1GXjNbIgCTFyq7h6LJJmHe4MpabN6a9lFyq7h:HEbMG5bIgcyC4LJJmHQpa/tyC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4924	4728	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 4728	1624	rundll32.exe	88
PID 1624 wrote to memory of 4728	1624	rundll32.exe	88
PID 1624 wrote to memory of 4728	1624	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c7a36f2002f575d8af200fe0ded3e08.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c7a36f2002f575d8af200fe0ded3e08.dll,#1
  2⤵
  PID:4728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 544
    3⤵
    - Program crash
    PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4728 -ip 4728
1⤵
PID:4928

memory/4728-0-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download