8780514bcb63aca7fa420abc98d9c00fae38b5a50a810170c273215e9eb7f7cf

Analysis

max time kernel
93s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 23:27

Target

8780514bcb63aca7fa420abc98d9c00fae38b5a50a810170c273215e9eb7f7cf.dll
Size

237KB
MD5

b775d61a241d7c0ee823c7ede82b8d3c
SHA1

f3c8f0ed2f8d05e915ac352588440d4f0a109d72
SHA256

8780514bcb63aca7fa420abc98d9c00fae38b5a50a810170c273215e9eb7f7cf
SHA512

69515edc723c535b7b85aed082762c40546f45d8db4127bf3dc596443273f3310fa68927a41ef4da54bfe50472e72b6b7901706d5ed3205b1c8ad30c2983f181
SSDEEP

1536:Iy950zrOCuMLmgMdXtXj7EFMb26UDPH7GVDgreE:IK8rOCvmgM9Ys26UPGttE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2200	4504	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 4504	224	rundll32.exe	82
PID 224 wrote to memory of 4504	224	rundll32.exe	82
PID 224 wrote to memory of 4504	224	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8780514bcb63aca7fa420abc98d9c00fae38b5a50a810170c273215e9eb7f7cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8780514bcb63aca7fa420abc98d9c00fae38b5a50a810170c273215e9eb7f7cf.dll,#1
  2⤵
  PID:4504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 604
    3⤵
    - Program crash
    PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4504 -ip 4504
1⤵
PID:2136