5617424f49f2a27dd3fa331a4fe364022055ebe7cb007033db57fea0fb1fff66

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 19:17

Target

5617424f49f2a27dd3fa331a4fe364022055ebe7cb007033db57fea0fb1fff66.dll
Size

205KB
MD5

9e7fa956d833f0d2d2866201468fd1a8
SHA1

1c2964777584bc8898be70699b3bf3983f53a676
SHA256

5617424f49f2a27dd3fa331a4fe364022055ebe7cb007033db57fea0fb1fff66
SHA512

4504474c2466e687ea8da5e52c22eea863ba7587975cc0ad1ac0fc4ec69c50986ff69c0cf017e11815b62fee7ee4ed2d213ee29f56c37ed27ae3d9f9e84335cb
SSDEEP

3072:v/QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUAp5pf:v/MEfuN0t8C5oFsoeRM3o0jJt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2464 4264 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2464	4264	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4308 wrote to memory of 4264	4308	rundll32.exe	rundll32.exe
PID 4308 wrote to memory of 4264	4308	rundll32.exe	rundll32.exe
PID 4308 wrote to memory of 4264	4308	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5617424f49f2a27dd3fa331a4fe364022055ebe7cb007033db57fea0fb1fff66.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4308

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5617424f49f2a27dd3fa331a4fe364022055ebe7cb007033db57fea0fb1fff66.dll,#1
2⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 632
3⤵
- Program crash
PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4264 -ip 4264
1⤵
PID:4160