7621f9c8e1c209bea1f341100fba2d4c29f79a2a2ccbc318598c355a6e74f939

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 06:58

Target

bdf7a98d806558528ad4459fc655d552.dll
Size

45KB
MD5

bdf7a98d806558528ad4459fc655d552
SHA1

eee8d73e06c4954ab3f8162110415c9775fdb90e
SHA256

7621f9c8e1c209bea1f341100fba2d4c29f79a2a2ccbc318598c355a6e74f939
SHA512

9f176ddf4461bb181e7c20f1da7d3274f8df172500e883a5fe435c64c5f4e4dba31a5debf2791ecdc4e00af2a042f9352027745d6d4b02535dd16b09b05de750
SSDEEP

768:Osy4uGBKS+csNaPy5PrfSJW7i+/4zhMux1iQKDHIjQEPnIeReUrEtb7GaXIa8:Os9IS+csoPy5PrfideDw/IeRpE5Gax8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	2264	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 2264	212	rundll32.exe	89
PID 212 wrote to memory of 2264	212	rundll32.exe	89
PID 212 wrote to memory of 2264	212	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdf7a98d806558528ad4459fc655d552.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdf7a98d806558528ad4459fc655d552.dll,#1
  2⤵
  PID:2264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 568
    3⤵
    - Program crash
    PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2264 -ip 2264
1⤵
PID:3880

memory/2264-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download