9b587f0574d013ada38f6973195e0ebcb1889952370dd3396e9f89e3622ff81a

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 01:43

Target

FileHash.dll
Size

531KB
MD5

2480394be8834caedf2040b240d225ea
SHA1

a5d4c485acf74a591a5e1d41e8f18e4b693f8db1
SHA256

ad0b9e5bf3feb17f41828323061472510ff726e4989ec7d547e4e91a7cf3fa4b
SHA512

00182d306fe8feeaacbc7c2dcbcce81dac3e518c2be77c4cef780bea31c133877fde6544124a2bb993c9865115b6034c2ba9ad037e57e46c47b22d310443dc8a
SSDEEP

6144:Or0P4W0zK8sKD2GbjEQ3ypNmUcTyMQ1biaA1+vlXhzYvbQRUncK4aPVLxS4PYbY:CvmhobjEQ4NmIV1uP1izQZfBCY

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

668 2180 WerFault.exe rundll32.exe

pid	pid_target	process	target process
668	2180	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1192 wrote to memory of 2180	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 2180	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 2180	1192	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FileHash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FileHash.dll,#1
2⤵
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 624
3⤵
- Program crash
PID:668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2180 -ip 2180
1⤵
PID:2944

memory/2180-0-0x0000000075330000-0x00000000753E9000-memory.dmp

Filesize
740KB

Download
memory/2180-1-0x0000000075330000-0x00000000753E9000-memory.dmp

Filesize
740KB

Download