d1042f46466b228bc5aa2978a0dee7a8f7f0a7f1a94112ebc7689a19090e0b47

Analysis

max time kernel
138s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 07:53

Target
742437c68d99d7eba73b7783128ed091.dll
Size 65KB
Sample240125-jq64macahk
SHA256 d1042f46466b228bc5aa2978a0dee7a8f7f0a7f1a94112ebc7689a19090e0b47
MD5 742437c68d99d7eba73b7783128ed091
SHA1 152182f29da0ce27a381f4e2e9f7220a538694cb
SHA512 ea4af3ca150160bb57f9c14a3f956349ca4bc395319a759e7e2653091f3c7cd5a34073a70a3fe95d84c5f09648e067b95b7888417756a8084e5447dca2dd78cf
SSDEEP 1536:14eT15OtK/VyM2t13fGftt25fNcuEaC8pGj5hazD7:55Oi2t13fGfru1cuQ8pkAzD7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2228	840	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 840	4500	rundll32.exe	86
PID 4500 wrote to memory of 840	4500	rundll32.exe	86
PID 4500 wrote to memory of 840	4500	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\742437c68d99d7eba73b7783128ed091.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\742437c68d99d7eba73b7783128ed091.dll,#1
  2⤵
  PID:840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 592
    3⤵
    - Program crash
    PID:2228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 840 -ip 840
1⤵
PID:4680

memory/840-0-0x0000000077B16000-0x0000000077B17000-memory.dmp

Download