75b69131f5a3b7c1744784ee4a55c64a08be4cb9327d6cea3ae6c2ed3a505231

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 11:37

Target

75b69131f5a3b7c1744784ee4a55c64a08be4cb9327d6cea3ae6c2ed3a505231.dll
Size

2.2MB
MD5

478d11590a763ccf1846b71b12373115
SHA1

e9838f2008c1b575d3a134f2615fd1e7277facd3
SHA256

75b69131f5a3b7c1744784ee4a55c64a08be4cb9327d6cea3ae6c2ed3a505231
SHA512

f3d0d49f06151e21b64d031326dab55bdd52846470194ad3c7f777464e36cc8e1ae31986ecab5e1d5dad726d9f018210b2696ba692ffe82cc03819feb43adbfe
SSDEEP

49152:TJ20OM5Fym/8RgJNYM97tQjFozL19wNa/WgU:VfOM56yJgjFKp9JWgU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5004	1584	WerFault.exe	64

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 1584	4104	rundll32.exe	64
PID 4104 wrote to memory of 1584	4104	rundll32.exe	64
PID 4104 wrote to memory of 1584	4104	rundll32.exe	64

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\75b69131f5a3b7c1744784ee4a55c64a08be4cb9327d6cea3ae6c2ed3a505231.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\75b69131f5a3b7c1744784ee4a55c64a08be4cb9327d6cea3ae6c2ed3a505231.dll,#1
  2⤵
  PID:1584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 560
    3⤵
    - Program crash
    PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1584 -ip 1584
1⤵
PID:4928