b7eb93a00889bfde1e6a98cf5bd63d9801fb6ea6a4a668964c712cc2448ea648

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 05:45

Target

768be54a4fc734e405c129df81cac9ff.dll
Size

37KB
MD5

768be54a4fc734e405c129df81cac9ff
SHA1

fb78277d4baaf9b0cada389a5ac47c6c271fa840
SHA256

b7eb93a00889bfde1e6a98cf5bd63d9801fb6ea6a4a668964c712cc2448ea648
SHA512

8978e36e997318cb696950a9e7e7615ba10ad9ac4aca6b3a33b40abba75601414c953216ed6838faaecaea7c9f7cd6b1d4d42058d54216e970e42cacee2f9a5b
SSDEEP

384:k63d3/QH4extHfzn6rb7VNVfY2Ar6KL3arbqH6sck/gGZJ4yI5z8gCM6s3AaIIHK:z3d/QHtNne/VjA2S3afpExPI5NdIwo5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4896	4692	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 4692	1608	rundll32.exe	84
PID 1608 wrote to memory of 4692	1608	rundll32.exe	84
PID 1608 wrote to memory of 4692	1608	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\768be54a4fc734e405c129df81cac9ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\768be54a4fc734e405c129df81cac9ff.dll,#1
  2⤵
  PID:4692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 548
    3⤵
    - Program crash
    PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4692 -ip 4692
1⤵
PID:112