5a459e9b766942ba673b6dd4efa7bee070f0043a7b74dbda6fa852cfb71a1db0

Analysis

max time kernel
92s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 22:39

Target

5a459e9b766942ba673b6dd4efa7bee070f0043a7b74dbda6fa852cfb71a1db0.dll
Size

48KB
MD5

b950fa9a85c10486d159f3265e608cc5
SHA1

720a7154b8478de00efba73e247215ea4028ddc3
SHA256

5a459e9b766942ba673b6dd4efa7bee070f0043a7b74dbda6fa852cfb71a1db0
SHA512

78dc5a0fa56f94b5dbf7b6f4d7db8ed7eb0fa626c5711084c3edf1e3fc972f67d7b60a8f8b81729d64887a922ab5fa141adaaab10d3630874ce5902f2a96a6dd
SSDEEP

768:qfOe7fFEHASORA2TuFx51qbIeQ5fjtlU9gHq3PqU8ZhoBPx7L:qfCHAVRA2TuFx5wbIeWfhlIyPoNx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
332	3644	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3644	4816	rundll32.exe	81
PID 4816 wrote to memory of 3644	4816	rundll32.exe	81
PID 4816 wrote to memory of 3644	4816	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a459e9b766942ba673b6dd4efa7bee070f0043a7b74dbda6fa852cfb71a1db0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a459e9b766942ba673b6dd4efa7bee070f0043a7b74dbda6fa852cfb71a1db0.dll,#1
  2⤵
  PID:3644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 564
    3⤵
    - Program crash
    PID:332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3644 -ip 3644
1⤵
PID:5032