79e5c48dd4d75d2aa224ea05cd5c115c9cb4e2acfac13dd30082a018dfc4f033

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 19:00

Target

87a5bbdf4315c1b4c6128e872fb8869a.dll
Size

237KB
MD5

87a5bbdf4315c1b4c6128e872fb8869a
SHA1

0a0fd4dd9c697b4974ad2d865acd652d426334f8
SHA256

79e5c48dd4d75d2aa224ea05cd5c115c9cb4e2acfac13dd30082a018dfc4f033
SHA512

93654aff69d64958872d4a9af236b4e0fa9aae8ecd0f115e6f912279c7c16413a02cde9c7bda466c67c9217b859a717607177dce350c4e3c03d7b098ef36e92f
SSDEEP

3072:fhv+G0K/6nyCkdEt7bvaUOAfYVLaTh/NRY48+iya7RPCkxSeZ3XPEQNkaS:f1AyCkdEt7bvaUd+LSX+yaN6kRZPEZa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4820	236	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 236	2536	rundll32.exe	83
PID 2536 wrote to memory of 236	2536	rundll32.exe	83
PID 2536 wrote to memory of 236	2536	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\87a5bbdf4315c1b4c6128e872fb8869a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\87a5bbdf4315c1b4c6128e872fb8869a.dll,#1
  2⤵
  PID:236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 236 -s 596
    3⤵
    - Program crash
    PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 236 -ip 236
1⤵
PID:704