a39a996c8e4f5cf23e4faefb874ae21f0dbcd91732dcb23e34a336606272d67c

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 11:37

Target

d603bb5bb10a36a7500d03c63e61faf3.dll
Size

324KB
MD5

d603bb5bb10a36a7500d03c63e61faf3
SHA1

913d3c0e46f45495e6eb70b5f9e6e20f963ca196
SHA256

a39a996c8e4f5cf23e4faefb874ae21f0dbcd91732dcb23e34a336606272d67c
SHA512

a78fa8af659916f323809936820d675c28bb6c78d6fb001472dfd04ed44610d12dfd5553963620aae1decb0549b769f338bf2caf67a88f5a897d604d75b47680
SSDEEP

6144:KImorCKk2dtez5zSuUncpAT9QTOyjjtnsAZJFPiITGnXVTbxpYFg1:KSCKkQ8xSuScpAqnj2MqIcXVTdG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3924	2568	WerFault.exe	89

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2568	rundll32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2568	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 2568	3180	rundll32.exe	89
PID 3180 wrote to memory of 2568	3180	rundll32.exe	89
PID 3180 wrote to memory of 2568	3180	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d603bb5bb10a36a7500d03c63e61faf3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d603bb5bb10a36a7500d03c63e61faf3.dll,#1
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 1224
    3⤵
    - Program crash
    PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2568 -ip 2568
1⤵
PID:1876

memory/2568-0-0x0000000013140000-0x0000000013251000-memory.dmp

Filesize
1.1MB

Download
memory/2568-1-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/2568-2-0x0000000013140000-0x0000000013251000-memory.dmp

Filesize
1.1MB

Download