3ffadb7209e13dece3a70539d16f71439e37ee040523d044e4820adc4095b2b7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 13:17

Target

c0af043827809e55fc268b7fefd69dc6.dll
Size

22KB
MD5

c0af043827809e55fc268b7fefd69dc6
SHA1

53f6cb92c24158d202760d4fe1c4d1a0eb18c5d5
SHA256

3ffadb7209e13dece3a70539d16f71439e37ee040523d044e4820adc4095b2b7
SHA512

746d8c4c7f6150e7f7e7991579c6dcb11106524a70d6961bfeb0d36fd066514e9c7e0f7ac047da898edd8d9a3d7559a5aa7f7d9960065f8239d9616db587a9a9
SSDEEP

384:eUcF+83n5g1phfGaj4sUUYGGtYw+kgG4O9Gucw21OhcXZ1MEtt1g:a7gXhLj4wGH4EGu/jIZ1jzO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3732	2264	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 2264	3332	rundll32.exe	89
PID 3332 wrote to memory of 2264	3332	rundll32.exe	89
PID 3332 wrote to memory of 2264	3332	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0af043827809e55fc268b7fefd69dc6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0af043827809e55fc268b7fefd69dc6.dll,#1
  2⤵
  PID:2264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 584
    3⤵
    - Program crash
    PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2264 -ip 2264
1⤵
PID:3324

memory/2264-0-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download