cb6eb8a9e55892c41d3fa63dbe365b2218c21d2d675daaba17c6ca9e58f15d1c

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 11:59

Target

86d64e2c01259150f691aec0d189dd9c.dll
Size

66KB
MD5

86d64e2c01259150f691aec0d189dd9c
SHA1

37c318f280bf19e5c301c6b3caac0fa276939ec3
SHA256

cb6eb8a9e55892c41d3fa63dbe365b2218c21d2d675daaba17c6ca9e58f15d1c
SHA512

25f1c731736343076ad374e4b3a23f442b3025d396dd19c91045a44aa4644b9d446f817ba330c14e9a76a88468361eb6702596553377c1ee2048feafeecc47c9
SSDEEP

1536:XeGhUZS1tJXNR7LC3hA80ttyHP7/0bnqybnT4osxpGKuZ:uYUqR7uokP7cbqonT4XKZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1128	1332	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1332	1372	rundll32.exe	85
PID 1372 wrote to memory of 1332	1372	rundll32.exe	85
PID 1372 wrote to memory of 1332	1372	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86d64e2c01259150f691aec0d189dd9c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\86d64e2c01259150f691aec0d189dd9c.dll,#1
  2⤵
  PID:1332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 548
    3⤵
    - Program crash
    PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1332 -ip 1332
1⤵
PID:2240

memory/1332-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download