0f9cd549a60e6803402dd5aaecfbe782e643d8ee8c58b970dec5ea6c20a65826

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 14:40

Target

b7a6617a91e3bbe3df5a17a05c9d28b8.dll
Size

60KB
MD5

b7a6617a91e3bbe3df5a17a05c9d28b8
SHA1

22cfbff0adc55c9949aab5c229f0bb6525581f10
SHA256

0f9cd549a60e6803402dd5aaecfbe782e643d8ee8c58b970dec5ea6c20a65826
SHA512

6c2d2ef70ed7b99e4c524ab7bc066ac09837dead67120a60ef5dbd19fe9cfabe811972754dbf2ae64cb007a3be90830728f745fb284333c5679269e75b282adc
SSDEEP

768:CXU1t9jf5CCN5FW4xXTUOycLPA439wP5iPgLa1zM7TS3odG8Y:SyfPXxXTTycr39foLa2QodG8Y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4928	3664	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3664	4984	rundll32.exe	87
PID 4984 wrote to memory of 3664	4984	rundll32.exe	87
PID 4984 wrote to memory of 3664	4984	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7a6617a91e3bbe3df5a17a05c9d28b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7a6617a91e3bbe3df5a17a05c9d28b8.dll,#1
  2⤵
  PID:3664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 612
    3⤵
    - Program crash
    PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3664 -ip 3664
1⤵
PID:3668