9bcecdee18877e22bc775ab32c42234e2f65300875008e2950966d07cc0ae33e

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2024 23:36

Target

665402f747d51c2c5e1697ac8e9c6da9.dll
Size

231KB
MD5

665402f747d51c2c5e1697ac8e9c6da9
SHA1

30c811ef0d18c02232b0e1f6843323261224a850
SHA256

9bcecdee18877e22bc775ab32c42234e2f65300875008e2950966d07cc0ae33e
SHA512

55b72c3baf033143ca720cfc9b62e6b921f817daa4cd47e7c858f9364549b604e288373d4e81c8a2e5317654cab4d24385d12debe8e60e6eaf244d13170cfb8d
SSDEEP

6144:zlcpp7LHIXawFY4mdClqCZKnSrKpw+BYQZSyK8zj:zqn77IXq4oCtAuKpw+BZZS78z

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
812	348	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 348	8	rundll32.exe	86
PID 8 wrote to memory of 348	8	rundll32.exe	86
PID 8 wrote to memory of 348	8	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\665402f747d51c2c5e1697ac8e9c6da9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\665402f747d51c2c5e1697ac8e9c6da9.dll,#1
  2⤵
  PID:348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 580
    3⤵
    - Program crash
    PID:812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 348 -ip 348
1⤵
PID:4116