f07bf397abd8b6bed01b838c3f332319c997f810ee5ec5087e761f1ccc39641a

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 01:15

Target

cpfe.dll
Size

4.9MB
MD5

f0114abee0d719dee97b78058453d387
SHA1

348558256ccfc339b70ba695b7a852c188354aed
SHA256

11d8e3ca83d044d7e5595caed143fb4634ba18834aceee82963a1b80432351bf
SHA512

9d2fa6b4b73abbfdbc3ef1b4581104d684269b4f9f3a5f50bf88d5b5805903cc524453162da4672a2175ce8efeba080e11d81e8bddd995d3ebb2c47ee5851b4b
SSDEEP

98304:aXvjpr5EwEbgUq1m7tXIbbEIrOnEYojXQi59+tqK6LGC/nN9ydiGfQ/Z35WBe8h+:2/N9ydQxp61hnnCIMZpgqO4UAH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1304	4224	WerFault.exe	15

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4224	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 4224	4272	rundll32.exe	15
PID 4272 wrote to memory of 4224	4272	rundll32.exe	15
PID 4272 wrote to memory of 4224	4272	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cpfe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cpfe.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 632
    3⤵
    - Program crash
    PID:1304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4224 -ip 4224
1⤵
PID:1768