73c6ddd5dc46eff1642fbb8cd7e1bd06131a38905b3a7fdda91336f0c1140bdd

Analysis

max time kernel
92s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 22:45

Target

73c6ddd5dc46eff1642fbb8cd7e1bd06131a38905b3a7fdda91336f0c1140bdd.dll
Size

135KB
MD5

cd28fda418470f3eb692e230e8e928fd
SHA1

e9d724df04bbb415126203a9420a1ce79d89b5a3
SHA256

73c6ddd5dc46eff1642fbb8cd7e1bd06131a38905b3a7fdda91336f0c1140bdd
SHA512

040c63d0305a50597fc13e82d10e93bd69f4719c4165d850634fb6b83f4bd649cecafbf03fcdd0b6ada0eab98ec93bd60302563f29d097f8e256712bfa4943e9
SSDEEP

3072:+rxH+fulSq6qEfTvyHoBbnS4frBdZoJBLvPAa:+rxH+fulSqlHHqbnSyfZoJxoa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1424	1572	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 1572	4460	rundll32.exe	83
PID 4460 wrote to memory of 1572	4460	rundll32.exe	83
PID 4460 wrote to memory of 1572	4460	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\73c6ddd5dc46eff1642fbb8cd7e1bd06131a38905b3a7fdda91336f0c1140bdd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\73c6ddd5dc46eff1642fbb8cd7e1bd06131a38905b3a7fdda91336f0c1140bdd.dll,#1
  2⤵
  PID:1572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 616
    3⤵
    - Program crash
    PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1572 -ip 1572
1⤵
PID:3704