4afe53f6e046a0f88f976e60599984d945fa166ce77eafc46893eecd50f2cf39

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 14:22

Target

b8f1255900dc97942434f6f906db07b2.dll
Size

296KB
MD5

b8f1255900dc97942434f6f906db07b2
SHA1

0a1e8e24331c63a1489c04767773ab567655bc2e
SHA256

4afe53f6e046a0f88f976e60599984d945fa166ce77eafc46893eecd50f2cf39
SHA512

21378dbf2092acfab6ffb334195e9672b6236f6a0d002881152b2429c0a5aa589a685bd2d76989df94c2ada61870f45a606e36db0953cd12c9d5266fb17954b4
SSDEEP

6144:lBTyPRqyhYPbncTBlhHrzndnkv0/1Q83cebsqQz5xr1+1cBgVqil11M:mJq8YPbncT3SZ8Meb+z5RTCblA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	1528	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 1528	2628	rundll32.exe	89
PID 2628 wrote to memory of 1528	2628	rundll32.exe	89
PID 2628 wrote to memory of 1528	2628	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8f1255900dc97942434f6f906db07b2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8f1255900dc97942434f6f906db07b2.dll,#1
  2⤵
  PID:1528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 640
    3⤵
    - Program crash
    PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1528 -ip 1528
1⤵
PID:3308