da16ce7550b5f62142729254139858b8e833bc483e03eaa9681c48f6a03e6f0b

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 06:39

Target
76a6ae557c6ffe8bcb74d308a3d7f004.dll
Size 135KB
Sample240126-herdcsgah5
SHA256 da16ce7550b5f62142729254139858b8e833bc483e03eaa9681c48f6a03e6f0b
MD5 76a6ae557c6ffe8bcb74d308a3d7f004
SHA1 f463e571710137285a9c6b40bad51aea98fe851e
SHA512 8182c4de406cdb82e7701e434b60317bdf849ab45ea2d7ba32bf4f873c04a94040e7ba195cc578d72664849d17884c5397d127c96b275abd37bd778179033aae
SSDEEP 1536:nuSM379pilzy4aCUBGbrufhif3ba/Qtps4zWeYXuOtMlZ:nu79WdaC2urufq33UeYuOE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4272	1692	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 1692	5084	rundll32.exe	81
PID 5084 wrote to memory of 1692	5084	rundll32.exe	81
PID 5084 wrote to memory of 1692	5084	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76a6ae557c6ffe8bcb74d308a3d7f004.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76a6ae557c6ffe8bcb74d308a3d7f004.dll,#1
  2⤵
  PID:1692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 548
    3⤵
    - Program crash
    PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1692 -ip 1692
1⤵
PID:3624