942f95d4beb77bd3b0ded67f8f8bd0d650302bb26252d5b910681ebe1b5fa27b

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 03:17

Target

ba60fc29028b9660be6d12d66f76857b.dll
Size

364KB
MD5

ba60fc29028b9660be6d12d66f76857b
SHA1

9684abce08d985751f05b7346f1f5e6e92602bfe
SHA256

942f95d4beb77bd3b0ded67f8f8bd0d650302bb26252d5b910681ebe1b5fa27b
SHA512

36675eec749f6e6dbd837827dd2bec0ac4843309cb2320a070eee3135cffac6f41bd80710f1fb6c710a2eef1e3244a6644851593a99b6dcf531caf03d80842cd
SSDEEP

6144:RTENYaV9XoE9pHCfj/xjlrNyTmDrZ+6IgsCm7esha2T64C8bq6qI8d6xZ52zkJfi:MYkHuT0Ty1+6MgQT64C5d0Z52AJfGoE9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3540	4288	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 4288	2520	rundll32.exe	90
PID 2520 wrote to memory of 4288	2520	rundll32.exe	90
PID 2520 wrote to memory of 4288	2520	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba60fc29028b9660be6d12d66f76857b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba60fc29028b9660be6d12d66f76857b.dll,#1
  2⤵
  PID:4288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 560
    3⤵
    - Program crash
    PID:3540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4288 -ip 4288
1⤵
PID:3580

memory/4288-0-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download
memory/4288-1-0x0000000001FA0000-0x00000000024B3000-memory.dmp

Filesize
5.1MB

Download