313fa1c4372d221f7be4eb9a6dc6c931cd9469371c81f5ed9380e99c032de88d

Analysis

max time kernel
115s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 01:09

Target

bf72fbc0651b92b3629c88f11d5ccf33.dll
Size

14KB
MD5

bf72fbc0651b92b3629c88f11d5ccf33
SHA1

9abae268fd4b11dd6494316c8c504dcecf5dcaae
SHA256

313fa1c4372d221f7be4eb9a6dc6c931cd9469371c81f5ed9380e99c032de88d
SHA512

6e80f002184c86d26702913cb641b7ec3ccc908d28c35304f57d195a50535b5321f7aca206f0116aefd071ad145dc265414e1060220efa25083cee9b49cebc30
SSDEEP

192:hpY7vWUc+xGyHrWvff6ZrUbDfRA03fyrZtoUJTdipp/kaKQ/KgQHAM8WregK:h6q9+xVr81BA03dNjcWb2AM8ng

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3692	4520	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 4520	1536	rundll32.exe	87
PID 1536 wrote to memory of 4520	1536	rundll32.exe	87
PID 1536 wrote to memory of 4520	1536	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf72fbc0651b92b3629c88f11d5ccf33.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf72fbc0651b92b3629c88f11d5ccf33.dll,#1
  2⤵
  PID:4520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 548
    3⤵
    - Program crash
    PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4520 -ip 4520
1⤵
PID:1884