a2d6989b51c067122484a897fbae2cfffa34750180f76d79bc069f2ff6b71c54

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 13:48

Target

53af2f0cf61876f0fc047f1a1b91f81c.dll
Size

92KB
MD5

53af2f0cf61876f0fc047f1a1b91f81c
SHA1

84629076a9f6931908f3d71a465145736ef58644
SHA256

a2d6989b51c067122484a897fbae2cfffa34750180f76d79bc069f2ff6b71c54
SHA512

5020b624a9224e126d9052ab9b79e3e9c9cb4c3293df20d0b4d282d8ac51198c5f1b0a165f8e75f5a7d361ae3015016e692dc4fe7feed47a46c11d75e728b8b6
SSDEEP

768:AXlmaMvhxrdneStK7vaYXJeMX0D9+2vPZggtWE2HlZdXRO8OxENUhXUUJXlLorAf:N/tV+P3J2vRruvulkjCphXMtFDr2C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2688	624	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 624	4412	rundll32.exe	14
PID 4412 wrote to memory of 624	4412	rundll32.exe	14
PID 4412 wrote to memory of 624	4412	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53af2f0cf61876f0fc047f1a1b91f81c.dll,#1
1⤵
PID:624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 632
  2⤵
  - Program crash
  PID:2688

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53af2f0cf61876f0fc047f1a1b91f81c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 624 -ip 624
1⤵
PID:1140