768cc5a6b01b7efd12babcbf4cf14d918cf55e734d7faa85e27eb2ef37837cd2

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 00:57

Target

768cc5a6b01b7efd12babcbf4cf14d918cf55e734d7faa85e27eb2ef37837cd2.dll
Size

144KB
MD5

d73aa04698b8d4cf4b10f2740064294d
SHA1

9154854440e487483c7654794b495a55327e625c
SHA256

768cc5a6b01b7efd12babcbf4cf14d918cf55e734d7faa85e27eb2ef37837cd2
SHA512

72006b4052ed22a53e21e111897bacd7d36dc2b8eee2ee912200a0bd52cca4aa3dd08823dda74a34b5d330266a99459fa8ffad5ba4d5f2fe510592a4c3816802
SSDEEP

3072:TVs3VXwgiYQg72JPEnMiARaba2DIO4Jm6NVO43rby:TVs3VXwgiYQg7gPGb9IO4Jm6PT3ru

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3528	1468	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1468	1700	rundll32.exe	87
PID 1700 wrote to memory of 1468	1700	rundll32.exe	87
PID 1700 wrote to memory of 1468	1700	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\768cc5a6b01b7efd12babcbf4cf14d918cf55e734d7faa85e27eb2ef37837cd2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\768cc5a6b01b7efd12babcbf4cf14d918cf55e734d7faa85e27eb2ef37837cd2.dll,#1
  2⤵
  PID:1468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 656
    3⤵
    - Program crash
    PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1468 -ip 1468
1⤵
PID:1644