c82da8096ac26ba333ead98317b5a29e84b532930ffb6671313ba3946a534b45

Analysis

max time kernel
144s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 08:13

Target

5abdae9ad3daad7a10b8d6f663bbd999.dll
Size

19KB
MD5

5abdae9ad3daad7a10b8d6f663bbd999
SHA1

8df08514a5104380640f1988ea8374a84cda2f71
SHA256

c82da8096ac26ba333ead98317b5a29e84b532930ffb6671313ba3946a534b45
SHA512

291a69d694b7dcf673e667e861be131eedb3c877ff0e8beaa15ea8f04fbae0c034da09465f78f65c64d459595e086975be62a26c0d742054fc8288b60e6715cc
SSDEEP

384:dUzbhSxGnDqy9iAV2TzYfKMV7YZ2KJsIh2z8pdzlr6JBvw5hr:dx5y9i3YfKMtY37pdzN6JBo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4292	1960	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 1960	4452	rundll32.exe	14
PID 4452 wrote to memory of 1960	4452	rundll32.exe	14
PID 4452 wrote to memory of 1960	4452	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5abdae9ad3daad7a10b8d6f663bbd999.dll,#1
1⤵
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 628
  2⤵
  - Program crash
  PID:4292

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5abdae9ad3daad7a10b8d6f663bbd999.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1960 -ip 1960
1⤵
PID:4884