0533efd9a6a699e1223f97c2e19d7901ae1129e4969feebd861170b180b7746c

Analysis

max time kernel
136s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 04:53

Target

64846a3fd8aa6b30b4b5f87db57dc6b6.dll
Size

331KB
MD5

64846a3fd8aa6b30b4b5f87db57dc6b6
SHA1

8afc4a3e13a4642d545b10e3cd91ab11178aa29b
SHA256

0533efd9a6a699e1223f97c2e19d7901ae1129e4969feebd861170b180b7746c
SHA512

5a385a57cca2a3fffe094ec22ebbfdefe9499fcfa76d772c287bd2e365dfaf75acd498a765c669d02441a0514e6860fb6e67e808b8c336e38490e8c88b8b1f7a
SSDEEP

6144:4zgaJAfgvWreQIkqr5Jr8+KPAr4hcJKwSU9ImZJ+TBQihVHX3s4:d/gvWlqr5lJecJTSU9V+T/n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2288	4144	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4144	4552	rundll32.exe	87
PID 4552 wrote to memory of 4144	4552	rundll32.exe	87
PID 4552 wrote to memory of 4144	4552	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64846a3fd8aa6b30b4b5f87db57dc6b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64846a3fd8aa6b30b4b5f87db57dc6b6.dll,#1
  2⤵
  PID:4144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 656
    3⤵
    - Program crash
    PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4144 -ip 4144
1⤵
PID:4088

memory/4144-0-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download