9c5f4710647ddb07139f0711b667cb62fdb93e51bad6d9964335db42c6745d33

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 22:56

Target

VirusShare-00c84ba7e1e5cbdd7d989a7b1779ab56.dll
Size

429KB
MD5

00c84ba7e1e5cbdd7d989a7b1779ab56
SHA1

ec9f628eb417e5504a84a0d930f58f1a4437522c
SHA256

9c5f4710647ddb07139f0711b667cb62fdb93e51bad6d9964335db42c6745d33
SHA512

8bd60763ea880742eb2d5bf3da5d537074bc924f2b969e7a60b45e584239ca2a5a1e1e15abc2c8e267cc709fdf17bcb459e37c7ece311391f09d651e154334c5
SSDEEP

6144:C9bHMF/eixGp9VCt81SJDzMW1xFqMqjUeHys2k9pk2U7KLgnEqd8lW7:mbFp9Yt81/ieUUDs2U7ZT7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4916	2632	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2632	1804	rundll32.exe	84
PID 1804 wrote to memory of 2632	1804	rundll32.exe	84
PID 1804 wrote to memory of 2632	1804	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare-00c84ba7e1e5cbdd7d989a7b1779ab56.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare-00c84ba7e1e5cbdd7d989a7b1779ab56.dll,#1
  2⤵
  PID:2632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 644
    3⤵
    - Program crash
    PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2632 -ip 2632
1⤵
PID:4264

memory/2632-0-0x0000000000730000-0x00000000007A0000-memory.dmp

Filesize
448KB

Download
memory/2632-1-0x0000000000730000-0x00000000007A0000-memory.dmp

Filesize
448KB

Download