3661fd8c83ca330baa8d1ce74b2b999b6041fc7e4b971f3fce00aa79b731de69

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2024 12:04

Target

7a32628bc8b43d904899405d66840cf7.dll
Size

201KB
MD5

7a32628bc8b43d904899405d66840cf7
SHA1

49e9ac9df85da9012dbd7c40722d42aa2e004775
SHA256

3661fd8c83ca330baa8d1ce74b2b999b6041fc7e4b971f3fce00aa79b731de69
SHA512

dff93a9f8bcf077ec02751e45b6bc40edfed096c7c8a9acb641173c6376db40a0784829f73c7188b4d0a8bbff5ee47a73ec04970e0c5381b3f635d0229710d30
SSDEEP

3072:pP/vjqD31pqLOZGMneT5+t3r++J/aSWxuM1d6JdRIN12W8tD8FTpTLimttNwZHVz:l/7ykLOZoTUV7YCRI/YtIqmttCZQRY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3960	4632	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4632	4324	rundll32.exe	87
PID 4324 wrote to memory of 4632	4324	rundll32.exe	87
PID 4324 wrote to memory of 4632	4324	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a32628bc8b43d904899405d66840cf7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a32628bc8b43d904899405d66840cf7.dll,#1
  2⤵
  PID:4632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 624
    3⤵
    - Program crash
    PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4632 -ip 4632
1⤵
PID:1264

memory/4632-0-0x00000000026A0000-0x00000000026B6000-memory.dmp

Filesize
88KB

Download