46c8c28b9f186929ede4971a558d4425d391e7782bcc6fcdc2c5834b5a4c98fa

Analysis

max time kernel
164s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 04:24

Target

bda759ee56a0e967478b1a113041e29e.dll
Size

160KB
MD5

bda759ee56a0e967478b1a113041e29e
SHA1

c17508773c226cc6df3604edf9cbed9917d89cfe
SHA256

46c8c28b9f186929ede4971a558d4425d391e7782bcc6fcdc2c5834b5a4c98fa
SHA512

32d5825b5fbcd99255e6772a7ee787bd05ae4d6035bfae471d84c5169687ba52661831f9d00fbece240630b06021552cf8204a9e16e48f9a393407280ecebae7
SSDEEP

3072:/HHJSGMVbYElA1t3mdmGEXgMxy9Kaz8EUXSDQ/pU3WtJd2J1hh:KYfkdHEXDxy9K1EC1psk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4828	4944	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4944	4276	rundll32.exe	88
PID 4276 wrote to memory of 4944	4276	rundll32.exe	88
PID 4276 wrote to memory of 4944	4276	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bda759ee56a0e967478b1a113041e29e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bda759ee56a0e967478b1a113041e29e.dll,#1
  2⤵
  PID:4944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 588
    3⤵
    - Program crash
    PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4944 -ip 4944
1⤵
PID:4408