fc474e4720a1fc163be56c3383ac49dbd1af526bbaf65a8fb6082d9e783a2ea9

Analysis

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 05:10

Target

795ab465f2df5000414eebd3e6d01bd6.dll
Size

127KB
MD5

795ab465f2df5000414eebd3e6d01bd6
SHA1

bde4ed9e15fe93d07aa57f0a8c064be7256b9ef4
SHA256

fc474e4720a1fc163be56c3383ac49dbd1af526bbaf65a8fb6082d9e783a2ea9
SHA512

4766165d41a14d2b79f2ccc513c9951236ff43fe1f762e1fd8a240c4cc67e8df5772d56adb4e3bd50f706806c1dfe62b764d1ec2707da0042492bf352b14904f
SSDEEP

3072:MdAisnp15xHw4EOwUN6KywVUC5lF1wKEw+P23kigxVbrqa8WBHQ:Pisz51HkHKdpfF1EbikqaL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2892	3012	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 3012	4684	rundll32.exe	87
PID 4684 wrote to memory of 3012	4684	rundll32.exe	87
PID 4684 wrote to memory of 3012	4684	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\795ab465f2df5000414eebd3e6d01bd6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\795ab465f2df5000414eebd3e6d01bd6.dll,#1
  2⤵
  PID:3012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 540
    3⤵
    - Program crash
    PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3012 -ip 3012
1⤵
PID:4328