9b614decaad63e72ec4fd3bb8ee845f141e9bee2cedc4d2a1415a53f94e5d3f8

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 09:32

Target

9b614decaad63e72ec4fd3bb8ee845f141e9bee2cedc4d2a1415a53f94e5d3f8.dll
Size

71KB
MD5

f1d902caf562a6d43526c1d105b40ef2
SHA1

715de23dd14344245ec351b388705bef043d8f34
SHA256

9b614decaad63e72ec4fd3bb8ee845f141e9bee2cedc4d2a1415a53f94e5d3f8
SHA512

3e1bb90c48ab486b833fb3285bd4e0e07a518d04ac40480206e2893536bf1a3ee91cae62684bff08f9b08986794e4da7f9e5d4cf4fdb6960aae97de11425ce81
SSDEEP

1536:TyM3oShqE5IpzDaT0SW5PV7DxrvrgtTvRuck7qVIZOVNgS9:T33oShqE5GDaT0SW5PlDxrTgZKgIZ0NP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3080	3832	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 3832	520	rundll32.exe	83
PID 520 wrote to memory of 3832	520	rundll32.exe	83
PID 520 wrote to memory of 3832	520	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b614decaad63e72ec4fd3bb8ee845f141e9bee2cedc4d2a1415a53f94e5d3f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b614decaad63e72ec4fd3bb8ee845f141e9bee2cedc4d2a1415a53f94e5d3f8.dll,#1
  2⤵
  PID:3832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 600
    3⤵
    - Program crash
    PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3832 -ip 3832
1⤵
PID:4468