6292fcf872fe9dddf2f02b1dc291b05f56dafdc860e87cb94aff7b1db81fe8b6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:31

Target

6292fcf872fe9dddf2f02b1dc291b05f56dafdc860e87cb94aff7b1db81fe8b6.dll
Size

1.4MB
MD5

be3371d8ccbf74c8bbd168f0a55baaf0
SHA1

3082931970e444d2b4be079d3db15f50ac46d4ab
SHA256

6292fcf872fe9dddf2f02b1dc291b05f56dafdc860e87cb94aff7b1db81fe8b6
SHA512

04aa9a155ecc012ac5e65fd0290823a7e1baed2a98055a945a63f75c39f6c38302fa903914e2b30c08d3ebaecc7e4ae282d7c3e487a4477e3b02030d3a3824a9
SSDEEP

24576:LLfjzsABmXbrfSnBKYxQgLKgCeDEUsc2SK3DdzxSVg:XfjzsAYPfuVf+fevtEDdFSVg

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2492 904 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2492	904	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1492 wrote to memory of 904	1492	rundll32.exe	rundll32.exe
PID 1492 wrote to memory of 904	1492	rundll32.exe	rundll32.exe
PID 1492 wrote to memory of 904	1492	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6292fcf872fe9dddf2f02b1dc291b05f56dafdc860e87cb94aff7b1db81fe8b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6292fcf872fe9dddf2f02b1dc291b05f56dafdc860e87cb94aff7b1db81fe8b6.dll,#1
2⤵
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 600
3⤵
- Program crash
PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 904 -ip 904
1⤵
PID:3068