cbbc3d1ac4ed991f08c7e9f4e78e847a8cfb0a4dec79bea78a11367ff2541d2d

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 08:47

Target

79cabec3a0bf3f190e436ae836213a73.dll
Size

40KB
MD5

79cabec3a0bf3f190e436ae836213a73
SHA1

09cb7c792e6a52d4519b8d205ae6091d5376c89d
SHA256

cbbc3d1ac4ed991f08c7e9f4e78e847a8cfb0a4dec79bea78a11367ff2541d2d
SHA512

907f8f5db123cc6e56bd6a5274e46022284ff7ff7c586866640fd3063a46de0a4fcb00f34dcc32c4ab6329a36dbe70f24b444ae138936a60583cd3ebf8c376f4
SSDEEP

384:s5L253Bx22U0EU3OnR78Q+vOu8kBsCcHSs3nRkh5siLz1zngE00Qc2MzrXOD:s5L2TQ2cR9+vjsXRa5skhrRPrXO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	5052	WerFault.exe	62

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 5052	2332	rundll32.exe	62
PID 2332 wrote to memory of 5052	2332	rundll32.exe	62
PID 2332 wrote to memory of 5052	2332	rundll32.exe	62

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79cabec3a0bf3f190e436ae836213a73.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\79cabec3a0bf3f190e436ae836213a73.dll,#1
  2⤵
  PID:5052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 624
    3⤵
    - Program crash
    PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5052 -ip 5052
1⤵
PID:2488