35eca44a8516f6e7354f245c6029ad766dfd74a94f3287a233477a22b250c834

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21-02-2024 16:40

Target

35eca44a8516f6e7354f245c6029ad766dfd74a94f3287a233477a22b250c834.dll
Size

4.2MB
MD5

9c5fc32466ce3cbbf1fc28241bcace16
SHA1

e2862b204a63d61af3c6d3ded3dea6ca7ba47a63
SHA256

35eca44a8516f6e7354f245c6029ad766dfd74a94f3287a233477a22b250c834
SHA512

637506e50abdd04795610b358a2cf72e0580eeb46706942e2ae2d1cfc442f098c589959edf483f2ef911c3ec996763f1ba4c595c23d4205fd5ed5f9e149e2e78
SSDEEP

49152:AGq1SZZLP9l968KSDXr+ktOHh9oJEv9PDsx2ndPwqFELm/XcCGfTETwmA93:tq1mKQwHh9PPDsxAP+LOm9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3164	2996	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 2996	888	rundll32.exe	87
PID 888 wrote to memory of 2996	888	rundll32.exe	87
PID 888 wrote to memory of 2996	888	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\35eca44a8516f6e7354f245c6029ad766dfd74a94f3287a233477a22b250c834.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\35eca44a8516f6e7354f245c6029ad766dfd74a94f3287a233477a22b250c834.dll,#1
  2⤵
  PID:2996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 736
    3⤵
    - Program crash
    PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2996 -ip 2996
1⤵
PID:3888

memory/2996-0-0x0000000002330000-0x0000000002770000-memory.dmp

Filesize
4.2MB

Download
memory/2996-2-0x0000000002330000-0x0000000002770000-memory.dmp

Filesize
4.2MB

Download