c26e35e2e04fd02dca61a8cf8982f08127cc1c09d7a09812f9a7d628cde052b9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 12:02

Target

5b30c1e9c5d4ea067b9fbaee0a1df7e4.dll
Size

318KB
MD5

5b30c1e9c5d4ea067b9fbaee0a1df7e4
SHA1

08162834c2e221f622e82669f4a62925ba989989
SHA256

c26e35e2e04fd02dca61a8cf8982f08127cc1c09d7a09812f9a7d628cde052b9
SHA512

e969bce536d4ce6368863cff1cfc1dbfe7eb484c7eb31ee7a59de34f84bc00533a8d37e9f48a9ec042eaebf83258431ccb606403350da89dd000c3d4075fa6ba
SSDEEP

6144:c5jnK3n3Dhpvv0ZPylfVIKqx3k/gH755nuAiPdrKIJf8CugqmksvNv/tAON82Iih:c5jnK3nThpvv0ZyVVId3k/GMN7NHyS8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1436	1408	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 1408	3456	rundll32.exe	16
PID 3456 wrote to memory of 1408	3456	rundll32.exe	16
PID 3456 wrote to memory of 1408	3456	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b30c1e9c5d4ea067b9fbaee0a1df7e4.dll,#1
1⤵
PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 572
  2⤵
  - Program crash
  PID:1436

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b30c1e9c5d4ea067b9fbaee0a1df7e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1408 -ip 1408
1⤵
PID:1184

memory/1408-0-0x0000000000970000-0x000000000097B000-memory.dmp

Filesize
44KB

Download