0a2f52aaca7b460c2af35b8a34abfc55c9f836eb9da6aa84710eb201c24feb3e

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 05:30

Target

d551fd00b28e290625ae15bc1e9c854e.dll
Size

96KB
MD5

d551fd00b28e290625ae15bc1e9c854e
SHA1

042242cac3789d29936845a7d39b2cb511c413c3
SHA256

0a2f52aaca7b460c2af35b8a34abfc55c9f836eb9da6aa84710eb201c24feb3e
SHA512

457c83c1fe4ee6e4fa2ed9585c98752a1865423ff00e7c7314f73477510e492a879a600bbd321d86199626871422e82a026b1047d5f06a369e3cd0abbdc8dd1b
SSDEEP

1536:V1iIkx77R1BkemDCNgq5Nwk6jty9CeQQ85qK5d7Bw7J+AKIG:/TO5MQ5ylysZP/7eG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4024	1956	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1956	536	rundll32.exe	88
PID 536 wrote to memory of 1956	536	rundll32.exe	88
PID 536 wrote to memory of 1956	536	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d551fd00b28e290625ae15bc1e9c854e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d551fd00b28e290625ae15bc1e9c854e.dll,#1
  2⤵
  PID:1956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 560
    3⤵
    - Program crash
    PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1956 -ip 1956
1⤵
PID:2564

memory/1956-0-0x0000000001230000-0x0000000001232000-memory.dmp

Filesize
8KB

Download