526160a5e4d3b4fa9a174d1912e9f5028cf4bad710215cea2a498bb8fbe9300a

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2024 00:42

Target

57888d9d068c8f63dd1dff1bbc548ddf.dll
Size

68KB
MD5

57888d9d068c8f63dd1dff1bbc548ddf
SHA1

00912c175dc53ae12a0813f2c0af487c53abdb23
SHA256

526160a5e4d3b4fa9a174d1912e9f5028cf4bad710215cea2a498bb8fbe9300a
SHA512

c3279de1a001ae2df499179e528944e3d335b79b84ad5b8c7d943a81169f0a7ec7fb77b203a4164d90044729058acf7d6a904ca6b82a5b8eb7cc0e9b18235358
SSDEEP

1536:iFzN559FOq3lXg/g9WCH2vjkU4KgFxKW5ZTL//NKPX2:gzPLXdZQkqQxKW5ZTL/lKPG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3524	2012	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 2012	4876	rundll32.exe	88
PID 4876 wrote to memory of 2012	4876	rundll32.exe	88
PID 4876 wrote to memory of 2012	4876	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57888d9d068c8f63dd1dff1bbc548ddf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\57888d9d068c8f63dd1dff1bbc548ddf.dll,#1
  2⤵
  PID:2012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 556
    3⤵
    - Program crash
    PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2012 -ip 2012
1⤵
PID:4108

memory/2012-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download