acc0262fb07599972c5198a33ece75d1cd5189858c205238bda05a886c4bf392

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 13:22

Target

acc0262fb07599972c5198a33ece75d1cd5189858c205238bda05a886c4bf392.dll
Size

120KB
MD5

6e4b9a7fa1c6343d1fa91348d60af134
SHA1

776af006bea0bdfde1865ff7cf8e641fe28239af
SHA256

acc0262fb07599972c5198a33ece75d1cd5189858c205238bda05a886c4bf392
SHA512

dc3b52245981d02496e01eb93d5bca6cfde76a3dc62918f153dadddacd02b808e9a7d50dbf387b088de5807440a226c13a59f870c4fb9e2dc4e8b070764a9b32
SSDEEP

3072:sm0qRQiSHpmMdM6hXutu0ckPxiTtu8cSfxaT6M5V:mEMdnNugM5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3628	5024	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 5024	3300	rundll32.exe	85
PID 3300 wrote to memory of 5024	3300	rundll32.exe	85
PID 3300 wrote to memory of 5024	3300	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\acc0262fb07599972c5198a33ece75d1cd5189858c205238bda05a886c4bf392.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\acc0262fb07599972c5198a33ece75d1cd5189858c205238bda05a886c4bf392.dll,#1
  2⤵
  PID:5024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 652
    3⤵
    - Program crash
    PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5024 -ip 5024
1⤵
PID:1204