0bd914dac8e1d70913d97abd111dd607116a996a36ee6e982fd42962da50cff9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 18:31

Target

0bd914dac8e1d70913d97abd111dd607116a996a36ee6e982fd42962da50cff9.dll
Size

439KB
MD5

857f3e5568a6dd96eeb15d04021fec2e
SHA1

12e16107a5d314b18c2553de37d81265420e2692
SHA256

0bd914dac8e1d70913d97abd111dd607116a996a36ee6e982fd42962da50cff9
SHA512

1020c9ccd8d0eb822d7579fe6dd3de66f46845c7578932f47482c17518b706d212ad21061bd2c53d5a475529f181308057e533ad43a3694a3114cc8f1bbaa949
SSDEEP

6144:t5ZbwYs0Kje4bKTcl6yRbFY5hNktoZHyLIl5eWPoJmbiMjoJ+l:DZbwmBdTO6ykAoksx0JU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
752	1224	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 1224	3784	rundll32.exe	84
PID 3784 wrote to memory of 1224	3784	rundll32.exe	84
PID 3784 wrote to memory of 1224	3784	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bd914dac8e1d70913d97abd111dd607116a996a36ee6e982fd42962da50cff9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bd914dac8e1d70913d97abd111dd607116a996a36ee6e982fd42962da50cff9.dll,#1
  2⤵
  PID:1224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 644
    3⤵
    - Program crash
    PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1224 -ip 1224
1⤵
PID:4016

memory/1224-0-0x0000000000010000-0x0000000000084000-memory.dmp

Filesize
464KB

Download