9133a122a7490cb676cb187be188896efcd14a97fc7563d3831b7d115beefacd

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:44

Target

9133a122a7490cb676cb187be188896efcd14a97fc7563d3831b7d115beefacd.dll
Size

7.5MB
MD5

55f4024ed46a5bed539ed9bb49077c64
SHA1

4e9edc1e9f39d31a8fa101513b35249c1c52f399
SHA256

9133a122a7490cb676cb187be188896efcd14a97fc7563d3831b7d115beefacd
SHA512

d9d3901dcbaa6a93540e847d40257423e6c24d10616595e597defa105f2f191b3182eb21c5287cda3bdf6a63073f7c82fbcedc40b76f42d54ee27f9a7761e187
SSDEEP

49152:UTXYcZYlrXIGLF3LyzADx04LolcAKqyLCtmorGWQKojLje3DitHxQH7kn3L:UTXtC+GIze0YoFKqyLcNGhRkDSHxu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3436 3468 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3436	3468	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3360 wrote to memory of 3468	3360	rundll32.exe	rundll32.exe
PID 3360 wrote to memory of 3468	3360	rundll32.exe	rundll32.exe
PID 3360 wrote to memory of 3468	3360	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9133a122a7490cb676cb187be188896efcd14a97fc7563d3831b7d115beefacd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3360

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9133a122a7490cb676cb187be188896efcd14a97fc7563d3831b7d115beefacd.dll,#1
2⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 544
3⤵
- Program crash
PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3468 -ip 3468
1⤵
PID:4268