e992e4b7746da21bc993d165c02cafba83b77a33351a971b0e51da62d3c851be

Analysis

max time kernel
137s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2024 13:51

Target

99959e030835fc522b247a1d977cde6d.dll
Size

50KB
MD5

99959e030835fc522b247a1d977cde6d
SHA1

b701d00319fab655462ba73395471c4e3615cdc9
SHA256

e992e4b7746da21bc993d165c02cafba83b77a33351a971b0e51da62d3c851be
SHA512

6d220997c37269418659628e20acf5a2d15629faaa0eddc0cc4603ef3ccc3590ad12fe1d41535d6dbf5bf368effd489c901b643095c01b58922cb8428767d143
SSDEEP

768:XIj6VLY52WQ1zIhLd4oa52FIlTr0QtJFcmiMft7X1i4Mz+F0T5MWd5:XIj6VLYkWuT5mC0qgbM/ijxaWd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1420	4488	WerFault.exe	40

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 4488	4496	rundll32.exe	40
PID 4496 wrote to memory of 4488	4496	rundll32.exe	40
PID 4496 wrote to memory of 4488	4496	rundll32.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99959e030835fc522b247a1d977cde6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\99959e030835fc522b247a1d977cde6d.dll,#1
  2⤵
  PID:4488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 568
    3⤵
    - Program crash
    PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4488 -ip 4488
1⤵
PID:4524