74243550366fd9b925513bda22bb9f5463bae786fe257571f3facf884c615b80

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 10:13

Target

71f5e5905952676e71af32c9a80ad57e.dll
Size

208KB
MD5

71f5e5905952676e71af32c9a80ad57e
SHA1

7f39c9ed7887f34046abe1d0d779956745f6dbec
SHA256

74243550366fd9b925513bda22bb9f5463bae786fe257571f3facf884c615b80
SHA512

768df9c650b6a351c1ec177f181e68080974290ddd35f174cd806d172cd6cb6a9c40761e13f76d35f952fdd876590f7d303d5043d744a48dc17abd02d405bfc9
SSDEEP

3072:VkUweLmbj5I7v/9/XYoJ47U3vBw77zEZYrofg0nOPOh7mlW7uwQOKXBwHvOUVZNr:2HpEXGgBqcgTE7VQd+vOUV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2780	4776	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 4776	2440	rundll32.exe	85
PID 2440 wrote to memory of 4776	2440	rundll32.exe	85
PID 2440 wrote to memory of 4776	2440	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\71f5e5905952676e71af32c9a80ad57e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\71f5e5905952676e71af32c9a80ad57e.dll,#1
  2⤵
  PID:4776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 552
    3⤵
    - Program crash
    PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4776 -ip 4776
1⤵
PID:632