a04c863ba82c5f2c40e76513665cca8a7977521beec91e9af9c3668ca4249f56

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2024 18:10

Target

bc783297ba9d4c2c9a91bd5041e015dc.dll
Size

25KB
MD5

bc783297ba9d4c2c9a91bd5041e015dc
SHA1

0f9f2028872860742e820313c48efcfe1566e76b
SHA256

a04c863ba82c5f2c40e76513665cca8a7977521beec91e9af9c3668ca4249f56
SHA512

16250bc9f467ca6986e78af1da85543678a2fbe5c1fff693bf450f3c567a13a64111e4720b475c0bdeaf944a6e6cb22cc601d1a06600117708358a6e686d7d1b
SSDEEP

384:jVEjC2jVG6b4KaerLgrK5ZqP2mHxqUXYxl4SKkDWXtWsDYFJS:uZxG6b4KpQrKH+RlKliZfDYFJS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
444	3128	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 3128	4104	rundll32.exe	88
PID 4104 wrote to memory of 3128	4104	rundll32.exe	88
PID 4104 wrote to memory of 3128	4104	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc783297ba9d4c2c9a91bd5041e015dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc783297ba9d4c2c9a91bd5041e015dc.dll,#1
  2⤵
  PID:3128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 648
    3⤵
    - Program crash
    PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3128 -ip 3128
1⤵
PID:4744

memory/3128-0-0x0000000001090000-0x00000000010AE000-memory.dmp

Filesize
120KB

Download