fc6d0aba600363db28eb8dff5b2e047507e830db8547ac0f0a6078b57342718c

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2024 08:30

Target

fc6d0aba600363db28eb8dff5b2e047507e830db8547ac0f0a6078b57342718c.dll
Size

462KB
MD5

c7fff78e0ae12a9cd11fca00385434a3
SHA1

43cd440991ab1148508316a04665388018455c1d
SHA256

fc6d0aba600363db28eb8dff5b2e047507e830db8547ac0f0a6078b57342718c
SHA512

60134e7de546a37f65325a903fca5a5bc3107c40e607df2f30e1e0d7854aedcf9d4e8c14d51bfb79b5766d76cc95feb383b87ae0216c0fb0b3f7bc5051a6daf4
SSDEEP

12288:Z1aDvpwK1OOWiP1W0qPbZ7UBveCs8mfBjvrEH70SZ:FK15WdbZ7UBveC8trEH70SZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4880	5108	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 5108	2136	rundll32.exe	85
PID 2136 wrote to memory of 5108	2136	rundll32.exe	85
PID 2136 wrote to memory of 5108	2136	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc6d0aba600363db28eb8dff5b2e047507e830db8547ac0f0a6078b57342718c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc6d0aba600363db28eb8dff5b2e047507e830db8547ac0f0a6078b57342718c.dll,#1
  2⤵
  PID:5108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 560
    3⤵
    - Program crash
    PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5108 -ip 5108
1⤵
PID:2584