5e0ee53c705c4df588a944e44d75e7e6601eb215a5302ba5938b9e77bd8a38c1

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 23:03

Target

5e0ee53c705c4df588a944e44d75e7e6601eb215a5302ba5938b9e77bd8a38c1.dll
Size

366KB
MD5

4ac97e22acf500d652e73df8283e7a3d
SHA1

6b75618c1928e27610738872dd607d9d70becc7c
SHA256

5e0ee53c705c4df588a944e44d75e7e6601eb215a5302ba5938b9e77bd8a38c1
SHA512

d6f3d0567a7676fc1d93569712248576619c326ca0c11a56c97f3ea50b74e6d7da67e03a06b3a3dbed6330eaa253a2f6aaf085a9ed03df6f8c9b3890c7141aa2
SSDEEP

6144:1iHnF+GbgMirMUHNv1nbYN4bVt0pF54/xWKoB6qaJEffHnZ6lS1L:14pcH38NoVtKF5sEKq6q3fHnZAS1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1388	3816	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 3816	2812	rundll32.exe	83
PID 2812 wrote to memory of 3816	2812	rundll32.exe	83
PID 2812 wrote to memory of 3816	2812	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e0ee53c705c4df588a944e44d75e7e6601eb215a5302ba5938b9e77bd8a38c1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e0ee53c705c4df588a944e44d75e7e6601eb215a5302ba5938b9e77bd8a38c1.dll,#1
  2⤵
  PID:3816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 748
    3⤵
    - Program crash
    PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3816 -ip 3816
1⤵
PID:2260