a6548331abe370edb816991aa2c004ea1871ce65730dc44a77cf5a364e580c74

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 17:11

Target

b939a783f8f748d97241eb9871fd3e2b.dll
Size

25KB
MD5

b939a783f8f748d97241eb9871fd3e2b
SHA1

2362aaccf02185440e4abf18365bfb7b3be94107
SHA256

a6548331abe370edb816991aa2c004ea1871ce65730dc44a77cf5a364e580c74
SHA512

fcfed2461668babc492634b2f7d8452d714adde930910100ee122464807aa69a4842a566a119a53ccf7967f591293f9bfb9fcedabdcab39cb395206752c579a1
SSDEEP

384:Hn8nWO/uznnLH59TtqMufgnHOZNZbG2FIKQ2fNaBNqhqoetZynSnnnniiq2nUtnf:28n4MnuZNVG2RnSNqhE5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	4272	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4272	4600	rundll32.exe	89
PID 4600 wrote to memory of 4272	4600	rundll32.exe	89
PID 4600 wrote to memory of 4272	4600	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b939a783f8f748d97241eb9871fd3e2b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b939a783f8f748d97241eb9871fd3e2b.dll,#1
  2⤵
  PID:4272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 540
    3⤵
    - Program crash
    PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4272 -ip 4272
1⤵
PID:3540

memory/4272-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download