02d9748d56c15931d1860763a22a26f009f792a33aedfcb8dfdff736ed8acb7c

Analysis

max time kernel
141s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 02:30

Target

bd6f6bb51cf7d447431d2dfcb2a6568e.dll
Size

239KB
MD5

bd6f6bb51cf7d447431d2dfcb2a6568e
SHA1

6af27f65d8794f9c19cdf1775c093c468d3aa70e
SHA256

02d9748d56c15931d1860763a22a26f009f792a33aedfcb8dfdff736ed8acb7c
SHA512

026917ea26e630c3ffd9415a543181f776cf0e62c58fd3a59cb8ca99825de4b8f8e049fd03aa65e269c4b1ac76cb9086b1fc7d61cc7476fa98a6e915682f8476
SSDEEP

3072:9WXRXSl+2Xl1SZJmrqIcAiQ5mdNXagj2u1EPYINqkBrtIYhEakFj1g8VzndpT+4G:YXhk+5Lm2IdiPDfwprEakVVz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1760	3744	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 3744	4276	rundll32.exe	89
PID 4276 wrote to memory of 3744	4276	rundll32.exe	89
PID 4276 wrote to memory of 3744	4276	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd6f6bb51cf7d447431d2dfcb2a6568e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd6f6bb51cf7d447431d2dfcb2a6568e.dll,#1
  2⤵
  PID:3744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 584
    3⤵
    - Program crash
    PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3744 -ip 3744
1⤵
PID:3920