72dada868d1a5acd05d9de4ce18493c81487d804729d2916da3351022a221a55

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 08:20

Target

98eeef9c52f7aec4f7ad3a7e08c56916.dll
Size

119KB
MD5

98eeef9c52f7aec4f7ad3a7e08c56916
SHA1

1c7d739a2bec5e8331ddd6cb0b4c7ee5c378ac86
SHA256

72dada868d1a5acd05d9de4ce18493c81487d804729d2916da3351022a221a55
SHA512

70e026e017477ce2cc1a22fd94819d8b33a9348b04a82895de2ff631dc2a42ebc5245d6569cfa0072b78c77cb7eeb831768c359f6672e2d3a576e626d65d3657
SSDEEP

1536:LSlvNYnd2uvHiMZsc8m63xaLom4CJNhNhUzzQcKN2+2gfGrNQtta3z0vgPzi7w99:kindHOcToRy6zzfKNd4NbygP+7eJf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1308	636	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 636	3904	rundll32.exe	84
PID 3904 wrote to memory of 636	3904	rundll32.exe	84
PID 3904 wrote to memory of 636	3904	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98eeef9c52f7aec4f7ad3a7e08c56916.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\98eeef9c52f7aec4f7ad3a7e08c56916.dll,#1
  2⤵
  PID:636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 604
    3⤵
    - Program crash
    PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 636 -ip 636
1⤵
PID:1588

memory/636-0-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download
memory/636-1-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download