239b0718d5e2547c97428242d468331fc243e3b8565ecd27abb6d76cd46ad98f

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 00:26

Target

239b0718d5e2547c97428242d468331fc243e3b8565ecd27abb6d76cd46ad98f.dll
Size

205KB
MD5

f6314580378772eade50d886fd272f97
SHA1

118b12acc65cef88ad387879c57ed21af3c074df
SHA256

239b0718d5e2547c97428242d468331fc243e3b8565ecd27abb6d76cd46ad98f
SHA512

a59a6aff6efc352225da97f6dc59013f75236cba72678695c97d979edd4cc7a34ba1f046d6ad4a4ae90cd4b8af409d994b59fabc164da49f48704add1fb1ddcb
SSDEEP

3072:v/QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUw5Yf:v/MEfuN0t8C5oFsoeRM3o0jE

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2488 972 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2488	972	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3172 wrote to memory of 972	3172	rundll32.exe	rundll32.exe
PID 3172 wrote to memory of 972	3172	rundll32.exe	rundll32.exe
PID 3172 wrote to memory of 972	3172	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\239b0718d5e2547c97428242d468331fc243e3b8565ecd27abb6d76cd46ad98f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3172

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\239b0718d5e2547c97428242d468331fc243e3b8565ecd27abb6d76cd46ad98f.dll,#1
2⤵
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 632
3⤵
- Program crash
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 972 -ip 972
1⤵
PID:2324