86baf95b760e6fd84bd1d1279c92a44e593a19a3830ec8f4a382253ef4392672

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 08:03

Target

4dc953560887407169cb63c860d9aa3d.dll
Size

86KB
MD5

4dc953560887407169cb63c860d9aa3d
SHA1

d150f0ed1c54f167ee66f0189e6632116d1836d2
SHA256

86baf95b760e6fd84bd1d1279c92a44e593a19a3830ec8f4a382253ef4392672
SHA512

7ea959612bc5878d117c1488eb2acd1a8931baa0b7318a75041d871e27deafe9967b37f086f5f88c5ef4e344962f879308a20008ddc9dbf337e8e3a96b62b8c7
SSDEEP

768:bs1Ju0l/IorZWtwPePzSAw/yj+TQyquuQeu4DTZFmwvEHNFGc+Me5SnF8xlDuRcg:bdY/IociKU/S+TkRhmwvU65UKDuRa00

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2508	340	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 340	1816	rundll32.exe	88
PID 1816 wrote to memory of 340	1816	rundll32.exe	88
PID 1816 wrote to memory of 340	1816	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dc953560887407169cb63c860d9aa3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dc953560887407169cb63c860d9aa3d.dll,#1
  2⤵
  PID:340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 560
    3⤵
    - Program crash
    PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 340 -ip 340
1⤵
PID:3972

memory/340-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/340-1-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download