660f6335e9c83b16aec67d19a61b89402f2678f35bf7e25f6f353aa650b06fc7

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 17:58

Target

c13cb7d7683d8973603060308a1f9b0b.dll
Size

345KB
MD5

c13cb7d7683d8973603060308a1f9b0b
SHA1

f6c0e12d14b04401898925214adf73e9818d3691
SHA256

660f6335e9c83b16aec67d19a61b89402f2678f35bf7e25f6f353aa650b06fc7
SHA512

62caacb563aaf6c27ab319dcdcfecaed4cb4ad7dd57b0842ff57cb3b8e7fe2874e22b680b4c90504b05aa2730ccbb3d5aff6bd9fdce338a1df53b3e5195861f5
SSDEEP

6144:1S3lNXAzp8DGf5DFcu4TDxnAEsTW8V7g4EW7qCbuF3lecRG9y14/3kWek12na9Kn:qlOaDGRDJ4JnAEsNV7JEW7q8SlmgUe8o

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	5048	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 5048	4036	rundll32.exe	88
PID 4036 wrote to memory of 5048	4036	rundll32.exe	88
PID 4036 wrote to memory of 5048	4036	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c13cb7d7683d8973603060308a1f9b0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c13cb7d7683d8973603060308a1f9b0b.dll,#1
  2⤵
  PID:5048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 628
    3⤵
    - Program crash
    PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5048 -ip 5048
1⤵
PID:1412

memory/5048-1-0x0000000010000000-0x0000000010059000-memory.dmp

Filesize
356KB

Download
memory/5048-0-0x00000000023D0000-0x00000000024D0000-memory.dmp

Filesize
1024KB

Download
memory/5048-3-0x0000000010000000-0x0000000010059000-memory.dmp

Filesize
356KB

Download