fed3ef647ef6c00079fec1f911876a234245b606ec1d879a9728bd81c0c7bb62

Analysis

max time kernel
138s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 17:06

Target
682c31393ac71834dab576eff952564c.dll
Size 72KB
Sample240119-vmkl1aaha9
SHA256 fed3ef647ef6c00079fec1f911876a234245b606ec1d879a9728bd81c0c7bb62
MD5 682c31393ac71834dab576eff952564c
SHA1 6616d7d6404c30f0638688ad251aa28da29ac33a
SHA512 925e99e388f0351ccb646f5629ebec1f402cb4bb259a09f9c34434dbfd54962aa7af5df41bb68e06ac2808de6d797bdb76744db7ed31b633609067402830beeb
SSDEEP 1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5116	4880	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4880	5020	rundll32.exe	84
PID 5020 wrote to memory of 4880	5020	rundll32.exe	84
PID 5020 wrote to memory of 4880	5020	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\682c31393ac71834dab576eff952564c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\682c31393ac71834dab576eff952564c.dll,#1
  2⤵
  PID:4880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 600
    3⤵
    - Program crash
    PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4880 -ip 4880
1⤵
PID:1652