125c26cb0fad9894c5cbaeaed2c5b22e5af70220d79a022f4276056f22af3bbb

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 22:24

Target

125c26cb0fad9894c5cbaeaed2c5b22e5af70220d79a022f4276056f22af3bbb.dll
Size

2.2MB
MD5

ac1a317613d221486f7bdd2354b85d22
SHA1

dc0b0eb65f2e7cd3eaf61100258ef8470929789a
SHA256

125c26cb0fad9894c5cbaeaed2c5b22e5af70220d79a022f4276056f22af3bbb
SHA512

a6e019ddeafa4ff85218d905678f0f0eac29e9a7778e58334ff170b6cacc2708f199059175e4ffa9c8b7c95fd6e8c05aaa4bb584df6d0da42289145497c1f6e9
SSDEEP

49152:TJd0OM5Fym/8RgJEYM97tQjFoHL19wNa/Wgk:VCOM56yJdjF6p9JWgk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1884	2828	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 2828	3908	rundll32.exe	83
PID 3908 wrote to memory of 2828	3908	rundll32.exe	83
PID 3908 wrote to memory of 2828	3908	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\125c26cb0fad9894c5cbaeaed2c5b22e5af70220d79a022f4276056f22af3bbb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\125c26cb0fad9894c5cbaeaed2c5b22e5af70220d79a022f4276056f22af3bbb.dll,#1
  2⤵
  PID:2828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 560
    3⤵
    - Program crash
    PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2828 -ip 2828
1⤵
PID:4492