f02556f4d95c19b6926a4c54cad0bb03fdde57b93564a37ef1669c532677f639

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 16:38

Target

d69a4d5b976c4a1c12f9487e6f03ccd7.dll
Size

221KB
MD5

d69a4d5b976c4a1c12f9487e6f03ccd7
SHA1

249c49923e3bd4e790152a4ee371bfabad3357ef
SHA256

f02556f4d95c19b6926a4c54cad0bb03fdde57b93564a37ef1669c532677f639
SHA512

a04b7b52cc79cf6840c6d10586851d42c63057e7e28143e58bfdc24b6a5c0bc53b369854c7844d0ed5c43aef7b8bd5126735079072c32a5f3110d3f3d548131a
SSDEEP

3072:bxeLb7rxhCNmRP4IiE69MbZqlqkTMxlxI1Jw8TFVFZYNFupA7yCzr7ZxWOAMRqcr:bsfFVR96TqkgxrI1OwVQjpRPN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4576	832	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 832	2388	rundll32.exe	86
PID 2388 wrote to memory of 832	2388	rundll32.exe	86
PID 2388 wrote to memory of 832	2388	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d69a4d5b976c4a1c12f9487e6f03ccd7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d69a4d5b976c4a1c12f9487e6f03ccd7.dll,#1
  2⤵
  PID:832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 596
    3⤵
    - Program crash
    PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 832 -ip 832
1⤵
PID:4968