9bb4313c2f131a672fa608ff240a16f247b11d83890a1615e43b02007d35a0e8

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 23:18

Target

9bb4313c2f131a672fa608ff240a16f247b11d83890a1615e43b02007d35a0e8.dll
Size

9.9MB
MD5

27ba9757b2f5cb9225ed04170da56248
SHA1

401c6d4b75ebcd30b183ffab99cb0e3b2a739359
SHA256

9bb4313c2f131a672fa608ff240a16f247b11d83890a1615e43b02007d35a0e8
SHA512

10507b87a6267b9e6a97b863fcb231942e3d0a8cbb8308f36bb917cde669abc760bb3ddb1ae0e4475c16cc7274e6163181b9eb637661cffb94c3421fc775884e
SSDEEP

98304:hrtnSYcv3qPJwFwUJ4nd6B3tcPXyZStcayro/BW7YBwcTp:/nSY3JwFwE48y2a

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1416	2964	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 2964	4984	rundll32.exe	90
PID 4984 wrote to memory of 2964	4984	rundll32.exe	90
PID 4984 wrote to memory of 2964	4984	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bb4313c2f131a672fa608ff240a16f247b11d83890a1615e43b02007d35a0e8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bb4313c2f131a672fa608ff240a16f247b11d83890a1615e43b02007d35a0e8.dll,#1
  2⤵
  PID:2964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 796
    3⤵
    - Program crash
    PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2964 -ip 2964
1⤵
PID:2032