461692969094ca29f52760944d6295655482bf57893ff4cef0ba207fbf914e7b

Analysis

max time kernel
91s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 23:48

Target

461692969094ca29f52760944d6295655482bf57893ff4cef0ba207fbf914e7b.dll
Size

2.1MB
MD5

b1ad3f3c59365c47658c232dfcd5f8fb
SHA1

2bc9c259d47d1be52fc6732cd49c2a68d04d7997
SHA256

461692969094ca29f52760944d6295655482bf57893ff4cef0ba207fbf914e7b
SHA512

d89c71731fecbe66c71cd75bb6d7f843caf10d43cfe75af74a6dcba102ea844a7db5e4101b6610d5bdf8b9c3b8346dbe12ecc5bffac5d72c4d4561ae473067e0
SSDEEP

49152:/Bx4NyGNomIJtQAfo9amEfZOkNPSTqctjwTj1uMsB:ZxB6omvEG0PSTqs4CB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3272	1940	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 1940	3472	rundll32.exe	85
PID 3472 wrote to memory of 1940	3472	rundll32.exe	85
PID 3472 wrote to memory of 1940	3472	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\461692969094ca29f52760944d6295655482bf57893ff4cef0ba207fbf914e7b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\461692969094ca29f52760944d6295655482bf57893ff4cef0ba207fbf914e7b.dll,#1
  2⤵
  PID:1940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 560
    3⤵
    - Program crash
    PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1940 -ip 1940
1⤵
PID:2096