d3a3fd970a93427d22718cf90785fd02e337017d88084190d03f3df508aedf41

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 17:55

Target

c13b7d742fa6cc645fa00f4b7a4483f8.dll
Size

135KB
MD5

c13b7d742fa6cc645fa00f4b7a4483f8
SHA1

dc59d76a56661a6c175116b2f37fd52bc33d4a11
SHA256

d3a3fd970a93427d22718cf90785fd02e337017d88084190d03f3df508aedf41
SHA512

4fcd4f3a85d11e79a52a90b512428d318ed6c6532b9096c8e437a562e220d3fd41f7d0ed90c61c61a23a5279da1946e36b734ff09cfb793061d3cd369af79b94
SSDEEP

1536:nuSM379pilzy4aCUBGbrufhif3ba/Qtps4zWeYXuOtMlj:nu79WdaC2urufq33UeYuOu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2340	3044	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 3044	4724	rundll32.exe	87
PID 4724 wrote to memory of 3044	4724	rundll32.exe	87
PID 4724 wrote to memory of 3044	4724	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c13b7d742fa6cc645fa00f4b7a4483f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c13b7d742fa6cc645fa00f4b7a4483f8.dll,#1
  2⤵
  PID:3044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 572
    3⤵
    - Program crash
    PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3044 -ip 3044
1⤵
PID:3676