c40dd0364e3b327849c68139e072db09b5f71ab38a8526865c47766a61f2364f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 13:05

Target

a3db86ff8ec6a30e07ad7830d8663ef7.dll
Size

1005KB
MD5

a3db86ff8ec6a30e07ad7830d8663ef7
SHA1

41b669a530f9cb2a3a140bc6037f3292ef066b9e
SHA256

c40dd0364e3b327849c68139e072db09b5f71ab38a8526865c47766a61f2364f
SHA512

53f1bee877ca947458cd547c69ee73351e25e5a9dd86a0e45a765025f59d1eb221dd5f3f24fe20bd11dc9d179f50df5c3d319c090fc2b990b8fa15f48e2e5807
SSDEEP

3072:TQuZG/ZMiE61ouqY7dtACZrzNp/c3Wh4CyPuf5Vlxl+ROXReazAOF/uIAPX2hjik:EESt3rg3s4CyPuffLvseT/uZ4ji8CA5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	2280	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2280	2732	rundll32.exe	85
PID 2732 wrote to memory of 2280	2732	rundll32.exe	85
PID 2732 wrote to memory of 2280	2732	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3db86ff8ec6a30e07ad7830d8663ef7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3db86ff8ec6a30e07ad7830d8663ef7.dll,#1
  2⤵
  PID:2280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 624
    3⤵
    - Program crash
    PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2280 -ip 2280
1⤵
PID:4332

memory/2280-0-0x0000000002090000-0x00000000020AE000-memory.dmp

Filesize
120KB

Download