e1c9f625d1e90cf571d1991c7ce475de9fbf18b39ad2c2722f7e9a494232a5ce

Analysis

max time kernel
142s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 11:35

Target

b74c62735416aafb8a5391ff907b3991.dll
Size

36KB
MD5

b74c62735416aafb8a5391ff907b3991
SHA1

b4cc2cc20bc58dbc899ff20fe011ba1b9527c131
SHA256

e1c9f625d1e90cf571d1991c7ce475de9fbf18b39ad2c2722f7e9a494232a5ce
SHA512

c8103cc0641535017ac4548e0f25374d5e4ce3a62494fe9fc4bf9c03d01ee41b8022c94be57e3cb36760e92a90efc29119a75c9a7e8f3b7ed53746ffc9e41d8a
SSDEEP

384:DiCdSo5CjLJdNGoYsGGtg6H2yAf7Mxm6t8eNu1q7/PsULF/7W757W:DNZ5CnJPGl6gA2yU7MxT8Sj0cte5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3272	4044	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 4044	3752	rundll32.exe	89
PID 3752 wrote to memory of 4044	3752	rundll32.exe	89
PID 3752 wrote to memory of 4044	3752	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b74c62735416aafb8a5391ff907b3991.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b74c62735416aafb8a5391ff907b3991.dll,#1
  2⤵
  PID:4044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 612
    3⤵
    - Program crash
    PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4044 -ip 4044
1⤵
PID:3228