b9e76a4278c5833422fe4b29d75bcd5856863b2fdea180f65250fa260b200bb7

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 13:49

Target

b9e76a4278c5833422fe4b29d75bcd5856863b2fdea180f65250fa260b200bb7.dll
Size

107KB
MD5

304ccd99a0b27ec17c9dfe4015bace44
SHA1

ed315687ab27b915b81e0eee5a917079f0fa0d56
SHA256

b9e76a4278c5833422fe4b29d75bcd5856863b2fdea180f65250fa260b200bb7
SHA512

e1b9b918fbb01a22d701c27bae9bc93eef82f3b4f9832174df95bc1f3f4771445db60ffa85894e2361616a25603f0448f4b01ce7070c129a23e1f79179188813
SSDEEP

1536:U/kDtfd+YbVzkHPjx+IWG4D1lAe0UsKyqkFzG5jsqAduFnToIfGrS+Ixsk:+/YbVzyPE4SSqjsqAdutTBfGrS+esk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4052	3060	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 3060	4820	rundll32.exe	85
PID 4820 wrote to memory of 3060	4820	rundll32.exe	85
PID 4820 wrote to memory of 3060	4820	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9e76a4278c5833422fe4b29d75bcd5856863b2fdea180f65250fa260b200bb7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9e76a4278c5833422fe4b29d75bcd5856863b2fdea180f65250fa260b200bb7.dll,#1
  2⤵
  PID:3060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 632
    3⤵
    - Program crash
    PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3060 -ip 3060
1⤵
PID:4808