45274c3a35e11d1e40942575d8fe7a34dac1ae3ed1ec74bf99e3b1dfab462f00

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 01:35

Target

55218f83e025560fce5f458e93dc869c.dll
Size

25KB
MD5

55218f83e025560fce5f458e93dc869c
SHA1

afb375a83cc587cf8818e9849d271a361c4f23d7
SHA256

45274c3a35e11d1e40942575d8fe7a34dac1ae3ed1ec74bf99e3b1dfab462f00
SHA512

7cae4a0b7440a113385407f1700e0f53c497c89e8b2d8d1e8a0f14fc2ee8a521a6c5b5b0c16cbe3bb688abfb73020cf2c87a2a1ed0cb43239e41134bcc226ca6
SSDEEP

384:QbRH3K6CvGPac81qBbJKDTCuP3MUWhYgXHwhSRWgvbFpw01nU7LKES3zBqaWWCij:yRXfCuCvqjQ2uPTuRHwhW5CyYCjbW5S

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4972	1624	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1624	1872	rundll32.exe	87
PID 1872 wrote to memory of 1624	1872	rundll32.exe	87
PID 1872 wrote to memory of 1624	1872	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55218f83e025560fce5f458e93dc869c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55218f83e025560fce5f458e93dc869c.dll,#1
  2⤵
  PID:1624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 548
    3⤵
    - Program crash
    PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1624 -ip 1624
1⤵
PID:4976

memory/1624-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download