961bde9e6d6eb0cb1b739262711f6b5059ef592cdbb17272a4cf1b742d80882e

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 06:33

Target

961bde9e6d6eb0cb1b739262711f6b5059ef592cdbb17272a4cf1b742d80882e.dll
Size

2.1MB
MD5

a174b62233cd02fcc2a05ab3d01cc23a
SHA1

5150667a899bfc1fa97868a87e07fa6a14442a7c
SHA256

961bde9e6d6eb0cb1b739262711f6b5059ef592cdbb17272a4cf1b742d80882e
SHA512

0d2b1814146623ca81b50b72aecb8cf8ff727b8e7da0cfa38880e69f184788e8be633a28c4b01aec5012e927db690d4280e64a112b271b961f493614de53ac97
SSDEEP

49152:sTIC9xRNavXa57okf/86lVijDRy6OTyZMWZ85X:KIAxfafae2mDRdZZ85X

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3644	3604	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 3604	384	rundll32.exe	83
PID 384 wrote to memory of 3604	384	rundll32.exe	83
PID 384 wrote to memory of 3604	384	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\961bde9e6d6eb0cb1b739262711f6b5059ef592cdbb17272a4cf1b742d80882e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\961bde9e6d6eb0cb1b739262711f6b5059ef592cdbb17272a4cf1b742d80882e.dll,#1
  2⤵
  PID:3604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 560
    3⤵
    - Program crash
    PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3604 -ip 3604
1⤵
PID:4860