001dadba99c7a1039ca8ee011a26dd053006f8c70887b43b900b80b93e0b1b41

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 22:52

Target

ad10454c965947a3658bb553ef009337.dll
Size

42KB
MD5

ad10454c965947a3658bb553ef009337
SHA1

f4ac2bef8e518fe27f69a04ecaea76e9137b2fd3
SHA256

001dadba99c7a1039ca8ee011a26dd053006f8c70887b43b900b80b93e0b1b41
SHA512

57c3c35afab3996b0e3e71fb001d78e0768b07ff29bb6f99535b9b64bfa980b936dab7bf8f13846e215ac124df60db08e071a7152fad4a1affc1e72e4940cfea
SSDEEP

768:s5TT7I1Nyc8Jxazo9olmzxjNfFhNGpWTZtThZILvks:s5TT7akpKoHFhNGpWTrhZILj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3340	3644	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 3644	1832	rundll32.exe	91
PID 1832 wrote to memory of 3644	1832	rundll32.exe	91
PID 1832 wrote to memory of 3644	1832	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad10454c965947a3658bb553ef009337.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad10454c965947a3658bb553ef009337.dll,#1
  2⤵
  PID:3644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 544
    3⤵
    - Program crash
    PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3644 -ip 3644
1⤵
PID:1372