c4737ddb142ea7c3dccd51f7c6cd6b45ed24ca95794b2afc020ed51685c102dd

Analysis

max time kernel
145s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 00:05

Target

c4737ddb142ea7c3dccd51f7c6cd6b45ed24ca95794b2afc020ed51685c102dd.dll
Size

5.4MB
MD5

1b6acb693da33c201cdcf261bccb8d9d
SHA1

b407eb6d9b74cf06630a028fb234ed679ae4c992
SHA256

c4737ddb142ea7c3dccd51f7c6cd6b45ed24ca95794b2afc020ed51685c102dd
SHA512

74b18f75d5f9236b6e3d42cb41b8872142362334cb45cc46e8100778e192b0158177ae059dec130fde6cdc492336f62322a703b7c9982f6f8b6ffdc64dd5db1c
SSDEEP

98304:xr7Qaz7xEpMA4Q7usmDRmyzfpPGtWVyRp1nNiWt4Du8:xXQaz7xEaXsmDR3YtsE94a8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3452	1872	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1872	2860	rundll32.exe	88
PID 2860 wrote to memory of 1872	2860	rundll32.exe	88
PID 2860 wrote to memory of 1872	2860	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4737ddb142ea7c3dccd51f7c6cd6b45ed24ca95794b2afc020ed51685c102dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4737ddb142ea7c3dccd51f7c6cd6b45ed24ca95794b2afc020ed51685c102dd.dll,#1
  2⤵
  PID:1872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 664
    3⤵
    - Program crash
    PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1872 -ip 1872
1⤵
PID:1552