0473ad5e256cb412cc0c5c07c20221c5dbf56e61383d652fa34b971a2ccfb6c7

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 11:28

Target
abc6bde11c7a9b8849b997262f99b43d.dll
Size 52KB
Sample240228-nldczaad52
SHA256 0473ad5e256cb412cc0c5c07c20221c5dbf56e61383d652fa34b971a2ccfb6c7
MD5 abc6bde11c7a9b8849b997262f99b43d
SHA1 3d48dbb83a9a7f1d143eb0087727ffb9692794c1
SHA512 442dff903b6a996a733fc78a057ac58a7f0a3e158e151bd1593884c35293bcc61765f55d3dffb9eed6472bd9bc0271217e50a2090c89c3ab106c586e9ec077af
SSDEEP 768:r3niJquQHLlwFh1DT4ETbn59QGX5n/0C6Q0H8rx69ktRfGp45t18Z0Lht8x:r3iJquQr40ETAGO72FttRtv8qLh6x
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4792	1200	WerFault.exe	72

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 1200	4988	rundll32.exe	72
PID 4988 wrote to memory of 1200	4988	rundll32.exe	72
PID 4988 wrote to memory of 1200	4988	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\abc6bde11c7a9b8849b997262f99b43d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\abc6bde11c7a9b8849b997262f99b43d.dll,#1
  2⤵
  PID:1200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 632
    3⤵
    - Program crash
    PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1200 -ip 1200
1⤵
PID:2796

memory/1200-0-0x0000000000730000-0x0000000000741000-memory.dmp

Download

memory/1200-1-0x0000000000730000-0x0000000000741000-memory.dmp

Download