fd73b4adb9d29bed9b8c93b64c674f303596c811caf12cf8d63dd31a5448622a

Analysis

max time kernel
92s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 18:41

Target

8fdf814c9d25a25dfd9b51d8cf805f3b.dll
Size

128KB
MD5

8fdf814c9d25a25dfd9b51d8cf805f3b
SHA1

da8603742eb94b7654c73bb54bbf7cb758aee0e3
SHA256

fd73b4adb9d29bed9b8c93b64c674f303596c811caf12cf8d63dd31a5448622a
SHA512

7c8f8d39e062a66e6a39f318560ffa67548db1fdf7f9a96503af21366ea86eeb51c9dea5a46666e8762c1811db8e157ed146632977c0516d22a2ef32d5afd397
SSDEEP

1536:dgvFMUT+u0W+9NfY9bjGbhTIkTd0JsZsUdYApm90cVe2wPb5JQ1KyyqBdDXpj4CT:d6LTZ9+nKS8cKYw0OwdcBBdD+CH+m

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1184	4524	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 4524	4176	rundll32.exe	15
PID 4176 wrote to memory of 4524	4176	rundll32.exe	15
PID 4176 wrote to memory of 4524	4176	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8fdf814c9d25a25dfd9b51d8cf805f3b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8fdf814c9d25a25dfd9b51d8cf805f3b.dll,#1
  2⤵
  PID:4524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 616
    3⤵
    - Program crash
    PID:1184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4524 -ip 4524
1⤵
PID:1376

memory/4524-0-0x0000000010000000-0x000000001014C000-memory.dmp

Filesize
1.3MB

Download
memory/4524-1-0x0000000010000000-0x000000001014C000-memory.dmp

Filesize
1.3MB

Download