2804051c3fab30cb43d07ddfd8d90e0b8040a037a2062bb26b433ebb5057bf70

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 18:29

Target

2804051c3fab30cb43d07ddfd8d90e0b8040a037a2062bb26b433ebb5057bf70.dll
Size

1.0MB
MD5

b7ceecde0b46b25af9ec608743eb389b
SHA1

ac3535773d8f37b2007645066d87ee158098e606
SHA256

2804051c3fab30cb43d07ddfd8d90e0b8040a037a2062bb26b433ebb5057bf70
SHA512

14276d5d1c1403b500cbeb3598d41cbd2efa6589f417272f789e4e94adddefe99db6b38a20ec14f40e1bb898b6c8bbc2892b4ca1949d59cc9bdaee7edd9a154a
SSDEEP

24576:m0Rdvjw14ZCWQuTOY4Qyz2Fj7ZS2Nv+4BT8+uPC:HDQDzKj7xXT3v

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3904	868	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 868	4612	rundll32.exe	87
PID 4612 wrote to memory of 868	4612	rundll32.exe	87
PID 4612 wrote to memory of 868	4612	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2804051c3fab30cb43d07ddfd8d90e0b8040a037a2062bb26b433ebb5057bf70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2804051c3fab30cb43d07ddfd8d90e0b8040a037a2062bb26b433ebb5057bf70.dll,#1
  2⤵
  PID:868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 652
    3⤵
    - Program crash
    PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 868 -ip 868
1⤵
PID:3984

memory/868-0-0x0000000000400000-0x000000000050F000-memory.dmp

Filesize
1.1MB

Download