c74be69bc6eda5a6f00848c553dac0af87da28a1fb78d2a895559d4f46cb6ac0

Analysis

max time kernel
93s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2024, 07:47

Target
81ddcb7db1642a2ff87ba7c0492334fa.dll
Size 73KB
Sample240130-jm2pqschek
SHA256 c74be69bc6eda5a6f00848c553dac0af87da28a1fb78d2a895559d4f46cb6ac0
MD5 81ddcb7db1642a2ff87ba7c0492334fa
SHA1 a34ce3627c682a770e216bbd41ff55365756900a
SHA512 c4f00081cd6a692335426f1f40da8f612a89a987b5dcabb6bd784f62b267c6a28420c8cb1ead6cffc26d0775d7ef10dffc2a5fd95c2bfb5bd9129cf981025730
SSDEEP 1536:q0K703Y7q6Vf3AQLFnToIfyTFjr5ZWN7WPHvR7J5sIF6NM1:X6Vf3AQLtTBfyTFjr5ZWN7WXRJyI8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2532	4516	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 4516	1880	rundll32.exe	83
PID 1880 wrote to memory of 4516	1880	rundll32.exe	83
PID 1880 wrote to memory of 4516	1880	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\81ddcb7db1642a2ff87ba7c0492334fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\81ddcb7db1642a2ff87ba7c0492334fa.dll,#1
  2⤵
  PID:4516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 684
    3⤵
    - Program crash
    PID:2532

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k krnlsrvc
1⤵
PID:1248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4516 -ip 4516
1⤵
PID:1664