ec46f223709ac7e59c6b6676077507c3af36bd67712aaf9df46c7a7bddc0eddd

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 10:53

Target

a1af9567a2a8955b82cb81563a2ba1de.dll
Size

47KB
MD5

a1af9567a2a8955b82cb81563a2ba1de
SHA1

46a7387a112594c2ddcbbbab061fe8658bc42667
SHA256

ec46f223709ac7e59c6b6676077507c3af36bd67712aaf9df46c7a7bddc0eddd
SHA512

319898c2736c27901df00503c5dcdbaeca0805b0df015b4751d11f0da31273ca97f6ee5634877164deba1224e817b38d949b16c1a41fa4dc4fb2d2d2dc126ff6
SSDEEP

768:/FPKzyiNdfqNoRfrmosfFM/88eKkRagFRHRf0MFcPFR5lDA6Oi5R9/0:/9IyiNdCiRjDsFF8eKkXf0fHDAkLd0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3960	3916	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3916	4852	rundll32.exe	85
PID 4852 wrote to memory of 3916	4852	rundll32.exe	85
PID 4852 wrote to memory of 3916	4852	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1af9567a2a8955b82cb81563a2ba1de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1af9567a2a8955b82cb81563a2ba1de.dll,#1
  2⤵
  PID:3916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 612
    3⤵
    - Program crash
    PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3916 -ip 3916
1⤵
PID:3648

memory/3916-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3916-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3916-1-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/3916-3-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3916-4-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download