0372a91760086d7aceaa88e2685cca267800768dfe75a7941c6308e9cdc00d08

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2024, 18:07

Target
b2c4e27b0eeaaec94a70e1ae0563d054.dll
Size 132KB
Sample240304-wqfmwsaa99
SHA256 0372a91760086d7aceaa88e2685cca267800768dfe75a7941c6308e9cdc00d08
MD5 b2c4e27b0eeaaec94a70e1ae0563d054
SHA1 92bdd97a5b821e77176ff7c03c1e347e8cd56a01
SHA512 3258200f0fd912a76a2475574d00084e78c67753513e739f9f2a8cf775022e1f381ec0dad396fea479bb9c6b09a3e26f87d0454e3f382a8ced4e18bf8600cc91
SSDEEP 1536:/f81S2WsGXq/giB4Ap7B9h6ktHI0Inm8xc3lqFV1Y8EZWkAA:/f0OBiBZ7B9gktoOV1T8gA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3188	1788	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 1788	3276	rundll32.exe	88
PID 3276 wrote to memory of 1788	3276	rundll32.exe	88
PID 3276 wrote to memory of 1788	3276	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2c4e27b0eeaaec94a70e1ae0563d054.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2c4e27b0eeaaec94a70e1ae0563d054.dll,#1
  2⤵
  PID:1788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 920
    3⤵
    - Program crash
    PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1788 -ip 1788
1⤵
PID:1640

memory/1788-0-0x0000000000AC0000-0x0000000000B0B000-memory.dmp

Download

memory/1788-1-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/1788-2-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/1788-3-0x0000000000AC0000-0x0000000000B0B000-memory.dmp

Download