a06ddd99f98cb9e024319b28cdda567fd86734d88a1ebfa95a43c944191f02a6

Analysis

max time kernel
160s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 06:22

Target

b40149f79cb6749efcfd8dedf281351c.dll
Size

45KB
MD5

b40149f79cb6749efcfd8dedf281351c
SHA1

61c83388045daf4b9dbde6eb1a81f5ae8a8d13f6
SHA256

a06ddd99f98cb9e024319b28cdda567fd86734d88a1ebfa95a43c944191f02a6
SHA512

00abc53fc1a1a3ea4a44489cd509b3fe7044d7416523b2507ff1d4c72700bde2d0169b98e6d242693d313cad12a44063e6db56a19d0325e2a6f0f1c2d88facfa
SSDEEP

768:oGSJm0aJlzTL1Zz8/90hAn/x37eZjQMN2Hq7XmMzaGH79wB44gk9a6gxSA5su8bM:kElzr8/9iGp37eZcMYyv9Ugk9a6g46s6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	2668	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 2668	3896	rundll32.exe	88
PID 3896 wrote to memory of 2668	3896	rundll32.exe	88
PID 3896 wrote to memory of 2668	3896	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b40149f79cb6749efcfd8dedf281351c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b40149f79cb6749efcfd8dedf281351c.dll,#1
  2⤵
  PID:2668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 616
    3⤵
    - Program crash
    PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2668 -ip 2668
1⤵
PID:5088

memory/2668-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2668-1-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download