e221c97c8b4361f114827fda6d45e2267eb045446fa67e0dd519ff2855ee7f82

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2024 21:07

Target

8d588dabfeb7ca42a7ee7fa6bac73782.dll
Size

360KB
MD5

8d588dabfeb7ca42a7ee7fa6bac73782
SHA1

0f10188dd72c787338557f3841ee856f35705201
SHA256

e221c97c8b4361f114827fda6d45e2267eb045446fa67e0dd519ff2855ee7f82
SHA512

906c6316929c8180f405c227d01e77606b093c05b50c624f5c0be329e193bda9ad6c5ed016b04a5a76773430843e81e605037c96db0dd07856d0bcb155a28edb
SSDEEP

6144:fwM3I4nEYm2WLZz9PGGISkraoIX4NRZLLd/BZpymJZBS+tSfEwv5wyQ1:4kI4nJmRz9PGGjkrgoN9Ppymfkn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	1956	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1956	2532	rundll32.exe	83
PID 2532 wrote to memory of 1956	2532	rundll32.exe	83
PID 2532 wrote to memory of 1956	2532	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d588dabfeb7ca42a7ee7fa6bac73782.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d588dabfeb7ca42a7ee7fa6bac73782.dll,#1
  2⤵
  PID:1956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 596
    3⤵
    - Program crash
    PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1956 -ip 1956
1⤵
PID:1256

memory/1956-0-0x0000000073E70000-0x0000000073ECD000-memory.dmp

Filesize
372KB

Download