ffe35206b8181f950b3b4d4d1793099fda9b204052b11bd7d095b93c2929854a

Analysis

max time kernel
93s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 09:52

Target

7cd1116fdd6dae04df634be24dbfaa4c.dll
Size

30KB
MD5

7cd1116fdd6dae04df634be24dbfaa4c
SHA1

cd979779df047a428693b286014f7e3f64ca3a70
SHA256

ffe35206b8181f950b3b4d4d1793099fda9b204052b11bd7d095b93c2929854a
SHA512

14a6a0debd4977695f1c47855bed8e7212a258d4967aad554eeee1ec65545f317501d60e12bcf5b5adf3b3ce6f9a828b20638e984e0cee0ff8475749b3121502
SSDEEP

384:tdiKGP+YRN8AnRfAysZwryoHBRV8//1poUbGlLWhduVIviXNfg+Sk8h8A2x3MNvv:m3Pjg2R4BS+gG//K8zvidY+N8h8BFM/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
508	1960	WerFault.exe	76

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 1960	2648	rundll32.exe	76
PID 2648 wrote to memory of 1960	2648	rundll32.exe	76
PID 2648 wrote to memory of 1960	2648	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7cd1116fdd6dae04df634be24dbfaa4c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7cd1116fdd6dae04df634be24dbfaa4c.dll,#1
  2⤵
  PID:1960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 560
    3⤵
    - Program crash
    PID:508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1960 -ip 1960
1⤵
PID:4744

memory/1960-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download