ae90dd0b3d80730a45d9b32d31664fcab384e5a345dbf224593fc888dcaac34c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 13:24

Target

ae90dd0b3d80730a45d9b32d31664fcab384e5a345dbf224593fc888dcaac34c.dll
Size

39KB
MD5

27bdfbe49d7a6f0609fd786e8ad9fff2
SHA1

2b12d03b0ab0aa8ad57d3aa8cdec25839977d81e
SHA256

ae90dd0b3d80730a45d9b32d31664fcab384e5a345dbf224593fc888dcaac34c
SHA512

aab47f7132f0510c07ef07ee8862dd11ec38edd9176ee67d36fbffffbabcdfe36bd972059da89bf6a9149f3e9af27084f0277e7e9fc3a9fb9f6458891aab8644
SSDEEP

768:WSfn/6vZQshffrscpKLRT8dggyifSW/VME8GdaXGiGyE:WSqfDscsgsW/VjtaXGiGyE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4452	788	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 788	3284	rundll32.exe	86
PID 3284 wrote to memory of 788	3284	rundll32.exe	86
PID 3284 wrote to memory of 788	3284	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae90dd0b3d80730a45d9b32d31664fcab384e5a345dbf224593fc888dcaac34c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae90dd0b3d80730a45d9b32d31664fcab384e5a345dbf224593fc888dcaac34c.dll,#1
  2⤵
  PID:788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 632
    3⤵
    - Program crash
    PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 788 -ip 788
1⤵
PID:5036