cd3667d1e13c1aac260da0cdd30f9e9d329088c161e57508c6021a01f59b1794

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 10:27

Target
b7315acb780dfb1c2157ac0adc5e3328.dll
Size 56KB
Sample240306-mhgesagh3v
SHA256 cd3667d1e13c1aac260da0cdd30f9e9d329088c161e57508c6021a01f59b1794
MD5 b7315acb780dfb1c2157ac0adc5e3328
SHA1 c189d957d9e7f5973fec82a9bd296214d0af1eb9
SHA512 0de483d8269a6d14ebd4ddb45a972c2319d56e7487de60a4ebe20c6efacb166706280a75a2d0e8dc221bc51608080c5d269144869b72e2130c8d48639a795e7a
SSDEEP 1536:thPn3JpuZB6vL0I8L3V5S38/Hyumtmku4alwpJCVvCd+G5:fnDuaT0H3V5fHyrmpbkR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3368	4800	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 4800	632	rundll32.exe	88
PID 632 wrote to memory of 4800	632	rundll32.exe	88
PID 632 wrote to memory of 4800	632	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7315acb780dfb1c2157ac0adc5e3328.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7315acb780dfb1c2157ac0adc5e3328.dll,#1
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 568
    3⤵
    - Program crash
    PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4800 -ip 4800
1⤵
PID:1864