a9b18fb9673a75feb05e3037fbc0a88a19be3b9b498375217d9323562291e408

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 23:25

Target

c71cdc41e5899a13677300ce2259bb9b.dll
Size

37KB
MD5

c71cdc41e5899a13677300ce2259bb9b
SHA1

8635a6edf4381a020aa9cf0587be856facf72d00
SHA256

a9b18fb9673a75feb05e3037fbc0a88a19be3b9b498375217d9323562291e408
SHA512

3a8b0f234c368f2cc3bcadb625cd2d3cd82b8587bf232510e8e75e484c3050184d9a7978bbd3131aa5185b53083ca03a8b0d303f4dce11150463dcba9841d38f
SSDEEP

768:sBR033t4tIWfIqzf0SC1N3v7fq3v+tqWMllxd8I333k333ShToP3U3hx:s0xxC0P1N3v7fq32tClHd8I333k333S9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4528	1504	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 1504	3508	rundll32.exe	90
PID 3508 wrote to memory of 1504	3508	rundll32.exe	90
PID 3508 wrote to memory of 1504	3508	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c71cdc41e5899a13677300ce2259bb9b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c71cdc41e5899a13677300ce2259bb9b.dll,#1
  2⤵
  PID:1504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 540
    3⤵
    - Program crash
    PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1504 -ip 1504
1⤵
PID:1936

memory/1504-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download