55e756d3ce6c7901e184d7d54665087dccfc84c729f9257d1bbd077c64ceb4bd

Analysis

max time kernel
139s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 21:51

Target

55e756d3ce6c7901e184d7d54665087dccfc84c729f9257d1bbd077c64ceb4bd.dll
Size

785KB
MD5

a1fea7e0569718e42c0987f42f95288f
SHA1

32601720e93a1d7446efc68c149cf089cbb959e2
SHA256

55e756d3ce6c7901e184d7d54665087dccfc84c729f9257d1bbd077c64ceb4bd
SHA512

198a2efe18f3b920614ac7f2f9a7bcf5bb085cff5d9b73e9d29e832107881735b464ca5d5e801fed60dc8efa1fa330f7b7f0b33da91e67c139dbc00d91c40d4c
SSDEEP

12288:Ttn0VzT6GU2YKUPmHMwKeEpn7TLkJK2B0a1kCSglGDPnWzzuvjkx62MZCTr1JqnJ:Z0EsUPsPfBzBfuvjkzM0Tr1J+uQDPr5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3932	3052	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 3052	2888	rundll32.exe	84
PID 2888 wrote to memory of 3052	2888	rundll32.exe	84
PID 2888 wrote to memory of 3052	2888	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55e756d3ce6c7901e184d7d54665087dccfc84c729f9257d1bbd077c64ceb4bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55e756d3ce6c7901e184d7d54665087dccfc84c729f9257d1bbd077c64ceb4bd.dll,#1
  2⤵
  PID:3052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 628
    3⤵
    - Program crash
    PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3052 -ip 3052
1⤵
PID:4140