572b3fbe6c29be35a47dfa8e78b03b7a2375fd275a06b0a137acaac1ca6de826

Analysis

max time kernel
93s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 10:33

Target

572b3fbe6c29be35a47dfa8e78b03b7a2375fd275a06b0a137acaac1ca6de826.dll
Size

599KB
MD5

9ead659345e83cd4034df67a86eefecb
SHA1

2ab19842749969c633bcc1e00e988a860f7feabf
SHA256

572b3fbe6c29be35a47dfa8e78b03b7a2375fd275a06b0a137acaac1ca6de826
SHA512

6423e2de8a10a294d20fd99167408cd4e3eec628c335814c82d40486dd5cd48a56d57dbd74d42111fd2901711aa9d4bebe09d5cf873f9d231fe43f542da9ec75
SSDEEP

12288:iaDXJ2/SZqeXILbbR8m117NTInWCBK//3djiErA0knb:bYLbbP112hk39rrhkb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4416	2480	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2480	2492	rundll32.exe	86
PID 2492 wrote to memory of 2480	2492	rundll32.exe	86
PID 2492 wrote to memory of 2480	2492	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\572b3fbe6c29be35a47dfa8e78b03b7a2375fd275a06b0a137acaac1ca6de826.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\572b3fbe6c29be35a47dfa8e78b03b7a2375fd275a06b0a137acaac1ca6de826.dll,#1
  2⤵
  PID:2480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 608
    3⤵
    - Program crash
    PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2480 -ip 2480
1⤵
PID:3800