59e7595049c655b8ec31b6b7c4ae9fcab3b63fdaa402595a5293d2b549b031f8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:31

Target

59e7595049c655b8ec31b6b7c4ae9fcab3b63fdaa402595a5293d2b549b031f8.dll
Size

8KB
MD5

f0a6b858e457d67c77889834bb655948
SHA1

19af4fe16cc23a8f3cfc08e493454bbf3c1af5e3
SHA256

59e7595049c655b8ec31b6b7c4ae9fcab3b63fdaa402595a5293d2b549b031f8
SHA512

e3bf170a2afa813fe6a2a24b48160b88056c4b0c9ff7a74cce118c8b89add2c47a2dd09867d33c10fa71b3017be9281f52016715a89755aa131b8aa63832e5ba
SSDEEP

192:3LFXpIUK5qKA2wOtN6KcVYwjcUFfxJl6AkJr4RFgcHtB:3XIUvKA27CKcVY2F5SvJrFcH

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3360 3536 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3360	3536	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4432 wrote to memory of 3536	4432	rundll32.exe	rundll32.exe
PID 4432 wrote to memory of 3536	4432	rundll32.exe	rundll32.exe
PID 4432 wrote to memory of 3536	4432	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59e7595049c655b8ec31b6b7c4ae9fcab3b63fdaa402595a5293d2b549b031f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4432

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59e7595049c655b8ec31b6b7c4ae9fcab3b63fdaa402595a5293d2b549b031f8.dll,#1
2⤵
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 548
3⤵
- Program crash
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3536 -ip 3536
1⤵
PID:4836