e8323c0e6aa8c636d4a63c04860f6bd678869dc84f1653208e7a65ceb2b344ac

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 20:44

Target

e8323c0e6aa8c636d4a63c04860f6bd678869dc84f1653208e7a65ceb2b344ac.dll
Size

1.8MB
MD5

5a7bf182ac8a0b87259fe7a52d12e554
SHA1

36b0000e21526f2276e5c4972bcf61486168c831
SHA256

e8323c0e6aa8c636d4a63c04860f6bd678869dc84f1653208e7a65ceb2b344ac
SHA512

45fdde902cef7324cb2ddbbb1ab37aa9a5df89ba57210f9e762c1c91ab84026582fc6d8a65251b587b658e2a73b95ee1037f9b6621bb4a0eeb23bbcb99bc5163
SSDEEP

24576:2T5Rvt2aRy3U2cJD1vOt6PQM9/giuAQRWhHRgXYRnr8TQdNcV9xsD1V:UkE3G4RMWBWoRr8Tn9xu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2824	4720	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 4720	3392	rundll32.exe	89
PID 3392 wrote to memory of 4720	3392	rundll32.exe	89
PID 3392 wrote to memory of 4720	3392	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8323c0e6aa8c636d4a63c04860f6bd678869dc84f1653208e7a65ceb2b344ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8323c0e6aa8c636d4a63c04860f6bd678869dc84f1653208e7a65ceb2b344ac.dll,#1
  2⤵
  PID:4720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 624
    3⤵
    - Program crash
    PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4720 -ip 4720
1⤵
PID:1984