814393029b07f8adee974e635fe2b1db5bd7ce9bacf8dfeb93b6462b562704fa

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 00:27

Target

814393029b07f8adee974e635fe2b1db5bd7ce9bacf8dfeb93b6462b562704fa.dll
Size

148KB
MD5

0b8ebf91c5eb6952cd831773d6c1fa40
SHA1

f797a1dcca1fc692a03c05d775f495576d4a9dee
SHA256

814393029b07f8adee974e635fe2b1db5bd7ce9bacf8dfeb93b6462b562704fa
SHA512

fa846f181bf2ff31d4b3611125f7994f5cbb8334425a62f408ed8cb35baa3d09dea2f457f3e5f777ddf4deda4e95679237ccbf3a6fb37f0a1ee169b6eef2d3c5
SSDEEP

3072:MdlNUsf/X+8mdujN/zYtjmDHDzRpIhq+KjQfULCExnbxM:MDO8OcnshQcUOOM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4104	1092	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1092	2944	rundll32.exe	84
PID 2944 wrote to memory of 1092	2944	rundll32.exe	84
PID 2944 wrote to memory of 1092	2944	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\814393029b07f8adee974e635fe2b1db5bd7ce9bacf8dfeb93b6462b562704fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\814393029b07f8adee974e635fe2b1db5bd7ce9bacf8dfeb93b6462b562704fa.dll,#1
  2⤵
  PID:1092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 640
    3⤵
    - Program crash
    PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1092 -ip 1092
1⤵
PID:3184

memory/1092-0-0x0000000000010000-0x0000000000039000-memory.dmp

Filesize
164KB

Download