18cd0d73406ced250fdffb5a509d5020e3620cc8148597077725164c796830f6

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 11:52

Target

c5cf6f035c0c71a9d418f6125634ff96.dll
Size

510KB
MD5

c5cf6f035c0c71a9d418f6125634ff96
SHA1

dd0905c6ae2873862c5d27339f98c64f881de04a
SHA256

18cd0d73406ced250fdffb5a509d5020e3620cc8148597077725164c796830f6
SHA512

ca72a8ab847a1c42641f0b93d5c2ff2a3c0315e8d3724fc159027346a4c462d1a4f8c2389df0d9e310f8995fa26a1131d691f22cf94a7e8f936a6ec9ead32eb9
SSDEEP

12288:8igdX9wIPeC+ieBfFKSr8Qf4VDRC2mwEqC246FiSup:rgdX9wIDEKS34nblCggSe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	3444	WerFault.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3444	rundll32.exe
3444	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 3444	2068	rundll32.exe	88
PID 2068 wrote to memory of 3444	2068	rundll32.exe	88
PID 2068 wrote to memory of 3444	2068	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5cf6f035c0c71a9d418f6125634ff96.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5cf6f035c0c71a9d418f6125634ff96.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 700
    3⤵
    - Program crash
    PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3444 -ip 3444
1⤵
PID:4972

memory/3444-0-0x0000000010000000-0x00000000100B7000-memory.dmp

Filesize
732KB

Download
memory/3444-1-0x00000000008A0000-0x00000000008CF000-memory.dmp

Filesize
188KB

Download
memory/3444-2-0x0000000010000000-0x00000000100B7000-memory.dmp

Filesize
732KB

Download
memory/3444-3-0x00000000008A0000-0x00000000008CF000-memory.dmp

Filesize
188KB

Download
memory/3444-5-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/3444-4-0x0000000010000000-0x00000000100B7000-memory.dmp

Filesize
732KB

Download
memory/3444-6-0x0000000010000000-0x00000000100B7000-memory.dmp

Filesize
732KB

Download
memory/3444-7-0x0000000010000000-0x00000000100B7000-memory.dmp

Filesize
732KB

Download
memory/3444-8-0x0000000010000000-0x00000000100B7000-memory.dmp

Filesize
732KB

Download
memory/3444-9-0x00000000008A0000-0x00000000008CF000-memory.dmp

Filesize
188KB

Download