ae4835b69e648da4e2bcba8b07c1c4dcdd5eba0646fe675aa3820a6fbb46ecab

Analysis

max time kernel
132s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2024 15:50

Target

6fd023ae576b52b1576c444563aa43cc.dll
Size

8.4MB
MD5

6fd023ae576b52b1576c444563aa43cc
SHA1

6f71746748c26b1f137385a837826e1294c994ec
SHA256

ae4835b69e648da4e2bcba8b07c1c4dcdd5eba0646fe675aa3820a6fbb46ecab
SHA512

9d5ce2e258b603a6b35d120613d3fa7808ca1ba8d902154ee46e01af04c9058b8a8f67e2058d5c420586466ea414bac66870679035eda2fb0d4cb7c5ce9eef3f
SSDEEP

196608:/9HP6Zpy9KyhMI54u8LljslNsyHFOxKAQ9HP6Zpy9KyhMI54u8LljslNsyHFOxKY:/9HP62FCdQ9HP62FCdi9HP62FCdG9HP+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	1812	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 1812	4080	rundll32.exe	88
PID 4080 wrote to memory of 1812	4080	rundll32.exe	88
PID 4080 wrote to memory of 1812	4080	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fd023ae576b52b1576c444563aa43cc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fd023ae576b52b1576c444563aa43cc.dll,#1
  2⤵
  PID:1812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 600
    3⤵
    - Program crash
    PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1812 -ip 1812
1⤵
PID:3896