c5166c868ed4835c35332350deccc83e72b85b5143367ed538e6fee32e4913d6

Analysis

max time kernel
92s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 11:00

Target

c5166c868ed4835c35332350deccc83e72b85b5143367ed538e6fee32e4913d6.dll
Size

1.6MB
MD5

a4df76f08fc4182f0ae7cff918a8296b
SHA1

5892744ea92502e180e8103fd9c04e714f6104dd
SHA256

c5166c868ed4835c35332350deccc83e72b85b5143367ed538e6fee32e4913d6
SHA512

9d642d0e9cd919ad6a50abadaa3e5953b8859708158435f28f24b07d5c7619bcd99cb936708cb9b61b45c20c56699a67b0ed4c95200dc8f3024989b871e8cd93
SSDEEP

12288:RaxDT9gYA8u9kkJ6uApoie2YYN0G0J3et0cIS2lxTfG5R2Mf:ODT9vIf2K00cB2q4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2984	4152	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 4152	3128	rundll32.exe	84
PID 3128 wrote to memory of 4152	3128	rundll32.exe	84
PID 3128 wrote to memory of 4152	3128	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5166c868ed4835c35332350deccc83e72b85b5143367ed538e6fee32e4913d6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5166c868ed4835c35332350deccc83e72b85b5143367ed538e6fee32e4913d6.dll,#1
  2⤵
  PID:4152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 632
    3⤵
    - Program crash
    PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4152 -ip 4152
1⤵
PID:2968