016f5bca9fea7be3da181db2a69d7386d6d09f7fb8b2225823d7f379bd75194d

Analysis

max time kernel
144s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 01:18

Target

016f5bca9fea7be3da181db2a69d7386d6d09f7fb8b2225823d7f379bd75194d.dll
Size

1.1MB
MD5

f664e772632b3ff3121f22c4d6a253a4
SHA1

d89619139d98a89b8f9c3b1cfb942d126d583e88
SHA256

016f5bca9fea7be3da181db2a69d7386d6d09f7fb8b2225823d7f379bd75194d
SHA512

764d862a885d09bf4850888010b9123695bef16b2d1c752fdf98950e9cf4112a721eaf84fc141ff277c893408cf5a544501d00e2dd1aacec46798abb9745843b
SSDEEP

24576:7kD9IKoDUuI8xDNkJ79vro8h+huO3IMJKEC89:H7/80oO4MJKu9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1496	1308	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 1308	3136	rundll32.exe	83
PID 3136 wrote to memory of 1308	3136	rundll32.exe	83
PID 3136 wrote to memory of 1308	3136	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\016f5bca9fea7be3da181db2a69d7386d6d09f7fb8b2225823d7f379bd75194d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\016f5bca9fea7be3da181db2a69d7386d6d09f7fb8b2225823d7f379bd75194d.dll,#1
  2⤵
  PID:1308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 652
    3⤵
    - Program crash
    PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1308 -ip 1308
1⤵
PID:4740

memory/1308-0-0x0000000001660000-0x0000000001661000-memory.dmp

Filesize
4KB

Download
memory/1308-1-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download