75e31e56d5735f7d52a7ec6f34f0415bc2778d638381981f7121581ba41b8cb3

Analysis

max time kernel
91s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 12:46

Target

7a4af142f5d13358c6f13f74aa6a5e58.dll
Size

652KB
MD5

7a4af142f5d13358c6f13f74aa6a5e58
SHA1

40581db03dedfb8f3e00768c1f5228950c2e26d7
SHA256

75e31e56d5735f7d52a7ec6f34f0415bc2778d638381981f7121581ba41b8cb3
SHA512

f6729cad994f8b8fa9f2847cb5b12678ed61296521e34a1096d7fe7f3e7557481f628482341e934fb402c4c64088691568c29750b0224b88662c03a7e5abc1d5
SSDEEP

12288:Gphkb4UkUGb2vypIFcv4N01Kh8mOVFwPI+QfTopBO8ZtmczaImvEAtE9RdxpgeWn:qkbZkZb2vy+cZ1Kh8vVFUI+QfTo33Vz3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3076	1320	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 1320	2784	rundll32.exe	84
PID 2784 wrote to memory of 1320	2784	rundll32.exe	84
PID 2784 wrote to memory of 1320	2784	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a4af142f5d13358c6f13f74aa6a5e58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a4af142f5d13358c6f13f74aa6a5e58.dll,#1
  2⤵
  PID:1320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 576
    3⤵
    - Program crash
    PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1320 -ip 1320
1⤵
PID:4952