16adf102e3ccea1c6588c6abdeb327438ce23ede76d786eec24f05749b4c4b63

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 06:04

Target

16adf102e3ccea1c6588c6abdeb327438ce23ede76d786eec24f05749b4c4b63.dll
Size

1.8MB
MD5

2733804117bde665cde1841bb696f632
SHA1

1cdc3155b9a13a79b6a199b3fa339331d7954905
SHA256

16adf102e3ccea1c6588c6abdeb327438ce23ede76d786eec24f05749b4c4b63
SHA512

dddc25af636625c622f7235a128c9b41c68ee3edd1c2a4b05d60ff4fdf5bba016223c780d977d8a6032d8dfa00d5c3db0271549ed11d199d51fcf54c5ed330af
SSDEEP

24576:KJVuKOZszKBPxVqtqUvyWs3CveT2zTjaj8sbd8ItXk6ByRxAY/HkRMj8y8w:KJ4LZszKBLqtZKc3Tapbub/4A

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5020	4128	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 4128	964	rundll32.exe	87
PID 964 wrote to memory of 4128	964	rundll32.exe	87
PID 964 wrote to memory of 4128	964	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\16adf102e3ccea1c6588c6abdeb327438ce23ede76d786eec24f05749b4c4b63.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\16adf102e3ccea1c6588c6abdeb327438ce23ede76d786eec24f05749b4c4b63.dll,#1
  2⤵
  PID:4128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 584
    3⤵
    - Program crash
    PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4128 -ip 4128
1⤵
PID:4580

memory/4128-0-0x0000000075180000-0x000000007540A000-memory.dmp

Filesize
2.5MB

Download
memory/4128-1-0x0000000075180000-0x000000007521B000-memory.dmp

Filesize
620KB

Download