81ed4111a9a5c77c2da56bca16f026b4e80f48afec6bb6825039543d56e6d405

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 23:24

Target
bf3b0d7795d7e15ed6d340476c2d0424.dll
Size 29KB
Sample240310-3d2g6aec61
SHA256 81ed4111a9a5c77c2da56bca16f026b4e80f48afec6bb6825039543d56e6d405
MD5 bf3b0d7795d7e15ed6d340476c2d0424
SHA1 32d19bf8588f56738d493e8f8568d4992c4f881f
SHA512 af1d932c22e2f3a9b8274e277f29cc8abe7165d48226af1a093e6f0a239637ff809e833468a3f6d9fb75333a7e65e4ba7c7e32fc1eb7439f8464fabbf879101a
SSDEEP 384:CWQnGHPxZB4yKthRh2FijIpEPEmi1qpzzGeKTtkQbymStfyNuz5Wg7Ca8X5Xf:HQe3KtXk1+JhEucXKaNuzTON5Xf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3396	4228	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 4228	1068	rundll32.exe	88
PID 1068 wrote to memory of 4228	1068	rundll32.exe	88
PID 1068 wrote to memory of 4228	1068	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf3b0d7795d7e15ed6d340476c2d0424.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf3b0d7795d7e15ed6d340476c2d0424.dll,#1
  2⤵
  PID:4228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 588
    3⤵
    - Program crash
    PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4228 -ip 4228
1⤵
PID:1216

memory/4228-0-0x0000000010000000-0x0000000010010000-memory.dmp

Download