9c2297bef69362c32d50b6ab18a0f5274099e4fd8ac6c68119ff918975d8e71d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 01:23

Target

9c2297bef69362c32d50b6ab18a0f5274099e4fd8ac6c68119ff918975d8e71d.dll
Size

6.3MB
MD5

ffb1e1ac949f4802c07223b054b3554f
SHA1

c689e72eb1cf2b4c71dffcdfe44638ca66013af5
SHA256

9c2297bef69362c32d50b6ab18a0f5274099e4fd8ac6c68119ff918975d8e71d
SHA512

028e16c0df2a00f3a72d59ea612fddaa48b62dcbb73db17b0aee7ea791cb9d274b0e32118415cc19011f6948b3c17dff62dce80f4c37daa9b29468482d42d0aa
SSDEEP

98304:uF/wLVIzIFPcYPAp7x4eXWkfPRHO6El2gEQu4lrRwuYU:uFILJ0YOeofpHO6EAmuh6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	4864	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 4864	2384	rundll32.exe	85
PID 2384 wrote to memory of 4864	2384	rundll32.exe	85
PID 2384 wrote to memory of 4864	2384	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c2297bef69362c32d50b6ab18a0f5274099e4fd8ac6c68119ff918975d8e71d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c2297bef69362c32d50b6ab18a0f5274099e4fd8ac6c68119ff918975d8e71d.dll,#1
  2⤵
  PID:4864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 560
    3⤵
    - Program crash
    PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4864 -ip 4864
1⤵
PID:1384