8670c847ca4356f5beef3738793b69ed0f64735b19bc043f3aa6b3eb5f18042e

Analysis

max time kernel
146s
max time network
7s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 07:41

Target

8670c847ca4356f5beef3738793b69ed0f64735b19bc043f3aa6b3eb5f18042e.dll
Size

2.2MB
MD5

344ff26cc638b84c24fe6ef4ae44b358
SHA1

1729a328b4291ca3d6125252f3b933f3649c5cb1
SHA256

8670c847ca4356f5beef3738793b69ed0f64735b19bc043f3aa6b3eb5f18042e
SHA512

38787fc96f9a66f4608ecbad3415ae67b1bfe0bc9abb5c0d434cf6ccbd7607aba5d52dbb6fc9d9f980841252f2c36d2d99b92562d9fe73bdb2b39622462d73f9
SSDEEP

49152:TJd0O6Fym/8RgJnYM97tQjFozL19wNa/Wg5:VCO66yJmjFKp9JWg5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5028	1644	WerFault.exe	13

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1644	2168	rundll32.exe	13
PID 2168 wrote to memory of 1644	2168	rundll32.exe	13
PID 2168 wrote to memory of 1644	2168	rundll32.exe	13

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8670c847ca4356f5beef3738793b69ed0f64735b19bc043f3aa6b3eb5f18042e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8670c847ca4356f5beef3738793b69ed0f64735b19bc043f3aa6b3eb5f18042e.dll,#1
  2⤵
  PID:1644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 564
    3⤵
    - Program crash
    PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1644 -ip 1644
1⤵
PID:1268