58aac90a083dde368a24718fe48b0de5bdfb0fbdab89b28170e8fdc05942677e

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 16:24

Target

510c2936b2a1b353525b140bcdc76be7.dll
Size

159KB
MD5

510c2936b2a1b353525b140bcdc76be7
SHA1

5a701de74e420eb5bd783d75bfd64f72fa107e5d
SHA256

58aac90a083dde368a24718fe48b0de5bdfb0fbdab89b28170e8fdc05942677e
SHA512

625736f70175eb67f58cefc51e12841d865ea2aeb2e27ce5bb8247a724ea597c0c880bf4aa022d200ec195fd97bd57fcb2531ce96842554cd12f5eef39acd6a1
SSDEEP

3072:uT9bXDlnu5nz3ouOsTIrj6tWiF9B3tlyiGZOimHYyetMO3FLW07VIm1S:OhXB0NOU2jmTpy4ZIUkZM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3556	2968	WerFault.exe	74

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 2968	764	rundll32.exe	74
PID 764 wrote to memory of 2968	764	rundll32.exe	74
PID 764 wrote to memory of 2968	764	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\510c2936b2a1b353525b140bcdc76be7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\510c2936b2a1b353525b140bcdc76be7.dll,#1
  2⤵
  PID:2968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 548
    3⤵
    - Program crash
    PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2968 -ip 2968
1⤵
PID:928