f8d0bc05e97e33a122e30d8f403f7b7aa3af1832b4bcb082bf53f63d06d73f4f

Analysis

max time kernel
144s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 15:01

Target

f8d0bc05e97e33a122e30d8f403f7b7aa3af1832b4bcb082bf53f63d06d73f4f.dll
Size

451KB
MD5

90645991858f0b3a3244e904ebd84dd2
SHA1

bbcffdc916aa71f8f19aa95fe28f1ae1f3da7354
SHA256

f8d0bc05e97e33a122e30d8f403f7b7aa3af1832b4bcb082bf53f63d06d73f4f
SHA512

15beb5c15f32cea7f30d63fbfcd36a694e24fb68bce341c6a9b34a9119fb57e6f7aa90f69923b25e69ae8b35d28a5ca4a39862550809837c183599e4216451ea
SSDEEP

12288:9507hDWyOku+3sG+D4+OeO+OeNhBBhhBB9xYBuJjBJYhL:9QKG+DdYUjBJYhL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3672	2640	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 2640	3428	rundll32.exe	85
PID 3428 wrote to memory of 2640	3428	rundll32.exe	85
PID 3428 wrote to memory of 2640	3428	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8d0bc05e97e33a122e30d8f403f7b7aa3af1832b4bcb082bf53f63d06d73f4f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f8d0bc05e97e33a122e30d8f403f7b7aa3af1832b4bcb082bf53f63d06d73f4f.dll,#1
  2⤵
  PID:2640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 552
    3⤵
    - Program crash
    PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2640 -ip 2640
1⤵
PID:4140

memory/2640-0-0x0000000010000000-0x0000000010077000-memory.dmp

Filesize
476KB

Download
memory/2640-1-0x0000000010000000-0x0000000010077000-memory.dmp

Filesize
476KB

Download