a778975e0e00a213f2e9b02c5def0181a9c488a522344f882051236f5b624c1e

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 01:22

Target

78e8713121c41bd4b4912c849a518220.dll
Size

84KB
MD5

78e8713121c41bd4b4912c849a518220
SHA1

03cc8d092355a01c6b49007abcccf272c130346a
SHA256

a778975e0e00a213f2e9b02c5def0181a9c488a522344f882051236f5b624c1e
SHA512

46cb68c5d52ad958acb92f8d0a9a7233c3d3ace85f964a0fa006b9d170b3c5f528feea458be6ee50deb4040706299d23b1f8296c7ba3966851ff4c4fc7265350
SSDEEP

1536:j4VK7rRhY/6nIMT2YxCgtNUBYLscvkrOC5TNgfSzP+vtMJ7MDr:j4KW/6nZxJtNUBcvkrBSvty7Mf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4068	4940	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 4940	4524	rundll32.exe	86
PID 4524 wrote to memory of 4940	4524	rundll32.exe	86
PID 4524 wrote to memory of 4940	4524	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78e8713121c41bd4b4912c849a518220.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78e8713121c41bd4b4912c849a518220.dll,#1
  2⤵
  PID:4940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 632
    3⤵
    - Program crash
    PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4940 -ip 4940
1⤵
PID:2272