aa046d041015c66cf270ecab25686f5a096853f522ffab9385ed6b466f5c5828

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 05:06

Target

529b4d566810028db912c396e9ed2860.dll
Size

144KB
MD5

529b4d566810028db912c396e9ed2860
SHA1

5a284e4d284d0146073f91b75cd3c242e3217fff
SHA256

aa046d041015c66cf270ecab25686f5a096853f522ffab9385ed6b466f5c5828
SHA512

f14b61c9e6fb02b61bcfb3a5b1e57e2e9d4aca8311f2c8b0ff110e91a828e52925bf53c79b494029fa15f7ba98ccc736e8ca44f991789ac88c8fb7606d626ce0
SSDEEP

1536:CmPgbL13HDuDfG2D8A+n3UirQY3BWXwHD9pRACj/r3Tezvd5SV/rIO/yv2tuQ+wz:XgbLZHg4QYRbdL3M5Gd/4hQPo4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3948	4048	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 4048	1500	rundll32.exe	14
PID 1500 wrote to memory of 4048	1500	rundll32.exe	14
PID 1500 wrote to memory of 4048	1500	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\529b4d566810028db912c396e9ed2860.dll,#1
1⤵
PID:4048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 736
  2⤵
  - Program crash
  PID:3948

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\529b4d566810028db912c396e9ed2860.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4048 -ip 4048
1⤵
PID:4860

memory/4048-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4048-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download