897c1482e0b29639d1f845e8c60f1ba97f8b86593da51961c565028db215ca63

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 00:53

Target

95d21b70b806549f0570f94b2562195e.dll
Size

27KB
MD5

95d21b70b806549f0570f94b2562195e
SHA1

3e22c781759be8b789cb1ed400f42c740ab493cd
SHA256

897c1482e0b29639d1f845e8c60f1ba97f8b86593da51961c565028db215ca63
SHA512

4ce2eb9568e9b739869714eb63f8e8876d63e12c32f323413334cd9b65626c703dd8c019d05c05f77e609e2d5e639b34f263ee8b8bb7887c6b2de60d6f37b680
SSDEEP

384:cEmTOdXR+UhAlFp/x0Pac6xkKHUbOS5Iv+3Y+zpESZ/lEMQak:lXR+UhADp5cadYO8c+o+z+Sdl/xk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4100	4756	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 4756	640	rundll32.exe	88
PID 640 wrote to memory of 4756	640	rundll32.exe	88
PID 640 wrote to memory of 4756	640	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95d21b70b806549f0570f94b2562195e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\95d21b70b806549f0570f94b2562195e.dll,#1
  2⤵
  PID:4756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 548
    3⤵
    - Program crash
    PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4756 -ip 4756
1⤵
PID:2444

memory/4756-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download