e5df6360b4a7329aa55157b3bf594e162987b8fb34c431cc318a9465f923aadb

Analysis

max time kernel
138s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 14:59

Target

8f7265d41a94b3a6691adedf2b8f3c22.dll
Size

52KB
MD5

8f7265d41a94b3a6691adedf2b8f3c22
SHA1

86151b456fbdc63aa7aab6b0c11640c3386cf320
SHA256

e5df6360b4a7329aa55157b3bf594e162987b8fb34c431cc318a9465f923aadb
SHA512

c561a11ab2f9b5b7b30e7c9e53ccb6858afccb38e02e75137360dc70f1a6d5aa2dfc1cc3ffbf08495ab4084d027b295b1a73a0759e81525e9072afbb4677622a
SSDEEP

1536:qaLA4GAavT4KafwDmU+kjdMaLA4GAavT4KafwDmU+kjd:xUN/sKEwDuaBUN/sKEwDua

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2632	4028	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 4028	1420	rundll32.exe	84
PID 1420 wrote to memory of 4028	1420	rundll32.exe	84
PID 1420 wrote to memory of 4028	1420	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f7265d41a94b3a6691adedf2b8f3c22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f7265d41a94b3a6691adedf2b8f3c22.dll,#1
  2⤵
  PID:4028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 544
    3⤵
    - Program crash
    PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4028 -ip 4028
1⤵
PID:4260