9fe525283cb7aa9780cd64c7864705a910ce6e3e87a99d51982e426761cd6534

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 17:48

Target

b54afe28a6d1dcfb3d6e193a85c239fa.dll
Size

180KB
MD5

b54afe28a6d1dcfb3d6e193a85c239fa
SHA1

bfcd82914b38af3c3f5d60d75d3e799c7d7f1a01
SHA256

9fe525283cb7aa9780cd64c7864705a910ce6e3e87a99d51982e426761cd6534
SHA512

75e2bb7ff8c31c97fb5b7559bd163a8f0d44aeb4c2e16f9eb4b5491e8c7557801cb02a9a17d6696fd7fb691f7b06a7111ce80c8f93738add500e63d665e3670b
SSDEEP

3072:z3wCFosP+dRvrwXD2RZQDfyOBZdyT10mloxqtWL8K9Ik9FNlAlEo22XIa9AoR7WR:z37GdRvuCZ0fRdy+mloxqtqB9IUFNKOv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2532	444	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 444	4324	rundll32.exe	89
PID 4324 wrote to memory of 444	4324	rundll32.exe	89
PID 4324 wrote to memory of 444	4324	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b54afe28a6d1dcfb3d6e193a85c239fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b54afe28a6d1dcfb3d6e193a85c239fa.dll,#1
  2⤵
  PID:444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 596
    3⤵
    - Program crash
    PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 444 -ip 444
1⤵
PID:4100