5c23a36bf787b5def49e8f73386e08f314cbed86f24238d87e6ba7f9b5d327d9

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 22:08

Target
5c23a36bf787b5def49e8f73386e08f314cbed86f24238d87e6ba7f9b5d327d9.dll
Size 76KB
Sample240525-1192pscb5t
SHA256 5c23a36bf787b5def49e8f73386e08f314cbed86f24238d87e6ba7f9b5d327d9
MD5 9940d63274f82bffd580c8c01ed47f07
SHA1 2f9a982fb8890a4ca097e224da4e8752353fc2c1
SHA512 ac08fe54ef3839ecf02ea34dc866546e5b6d7b9dc06268e5aea629c601e7cec0a192409624f918db8c065dc2b14d968948b80e5bd96f1c1ffb5f3e0b91cea1ab
SSDEEP 1536:BZZZZZZZZZZZZJOEDlwYSMQsGHxg0TS+XKyMqqU+2bbbAV2/S2TrKUm:zlZHQsozTS+1MqqDL2/TrK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3816	2264	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 2264	804	rundll32.exe	83
PID 804 wrote to memory of 2264	804	rundll32.exe	83
PID 804 wrote to memory of 2264	804	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c23a36bf787b5def49e8f73386e08f314cbed86f24238d87e6ba7f9b5d327d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c23a36bf787b5def49e8f73386e08f314cbed86f24238d87e6ba7f9b5d327d9.dll,#1
  2⤵
  PID:2264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 624
    3⤵
    - Program crash
    PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2264 -ip 2264
1⤵
PID:2380