6f048a2e0357817bbb198cae532d2f96b99ba25d516868bab094be45fa64c9a6

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 00:40

Target

b612bce5a8a8c49523c5b7c1c5362c19.dll
Size

205KB
MD5

b612bce5a8a8c49523c5b7c1c5362c19
SHA1

46ca4fc751ca932135a6c2045212322c91f14997
SHA256

6f048a2e0357817bbb198cae532d2f96b99ba25d516868bab094be45fa64c9a6
SHA512

70598a52ca90bc8202413478fbb9fd1bcda8c980e5f1fa98cb2aec0207804dd1d11f47262c46e34ee1abeed9589b2db646ebfdbfd25431ade7aa1f792953dcb5
SSDEEP

3072:twLvY6vUax8bweSS3MInP3CeXKhqwJ+N/EJoSun5K909XB47ZBD66wsv2uD:G/MaabwebMcyeXKhqeJoDYy47rNv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	3908	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3908	1936	rundll32.exe	87
PID 1936 wrote to memory of 3908	1936	rundll32.exe	87
PID 1936 wrote to memory of 3908	1936	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b612bce5a8a8c49523c5b7c1c5362c19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b612bce5a8a8c49523c5b7c1c5362c19.dll,#1
  2⤵
  PID:3908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 548
    3⤵
    - Program crash
    PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3908 -ip 3908
1⤵
PID:2904

memory/3908-0-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download