99d70d2f8218bd3e9f3b7ae14fe36dd58596a6be80ad63ac64e4d5c1f07dfa57

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 01:11

Target
99d70d2f8218bd3e9f3b7ae14fe36dd58596a6be80ad63ac64e4d5c1f07dfa57.dll
Size 76KB
Sample240525-bkdacshe68
SHA256 99d70d2f8218bd3e9f3b7ae14fe36dd58596a6be80ad63ac64e4d5c1f07dfa57
MD5 d5f4acd171718699ea0e5ea7a6acfb8a
SHA1 73b14f270b02175debaddc7fa2f92e1670461d4d
SHA512 296269bd627d6fefc1815799e27cdd34463980128b4d948831e2cf88161c31ccf40ca7792010cd094097074d191ff9a148215b3b404ab5e9cc6637132272f1df
SSDEEP 1536:bZZZZZZZZZZZZJmUDlwUSPsx/SxWcTSdBgmKaMqqU+2bbbAV2/S2TOKUw:Nlxwsx89TSdBgUMqqDL2/TOK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5020	4744	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 4744	3680	rundll32.exe	82
PID 3680 wrote to memory of 4744	3680	rundll32.exe	82
PID 3680 wrote to memory of 4744	3680	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\99d70d2f8218bd3e9f3b7ae14fe36dd58596a6be80ad63ac64e4d5c1f07dfa57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\99d70d2f8218bd3e9f3b7ae14fe36dd58596a6be80ad63ac64e4d5c1f07dfa57.dll,#1
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 632
    3⤵
    - Program crash
    PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4744 -ip 4744
1⤵
PID:2376