be0c25685b8133db06d089b0a895d9868e70890788cebae8dbddeccd7c36ea67

Analysis

max time kernel
113s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 10:58

Target

be0c25685b8133db06d089b0a895d9868e70890788cebae8dbddeccd7c36ea67.dll
Size

2.2MB
MD5

a5026b231902f7399a0a64c9624fb74a
SHA1

6df2f9ac75993ddb20e3a328a600fea37f00ca77
SHA256

be0c25685b8133db06d089b0a895d9868e70890788cebae8dbddeccd7c36ea67
SHA512

e5c955fb08052289413e2049e5388d723228f91330e02e6898807c4ed699962a31e184364cf6e6cd067547d051858213728a845fe3c8668abc74c52da85455fa
SSDEEP

49152:TJd0OnFym/8RgJdYM97tQjFozL19wNa/WgT:VCOn6yJwjFKp9JWgT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1012	936	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 936	4936	rundll32.exe	88
PID 4936 wrote to memory of 936	4936	rundll32.exe	88
PID 4936 wrote to memory of 936	4936	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be0c25685b8133db06d089b0a895d9868e70890788cebae8dbddeccd7c36ea67.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\be0c25685b8133db06d089b0a895d9868e70890788cebae8dbddeccd7c36ea67.dll,#1
  2⤵
  PID:936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 560
    3⤵
    - Program crash
    PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 936 -ip 936
1⤵
PID:3060