c67859c31490779164c623e9ea601f4b5a4703905356662baca0b229aded5e41

Analysis

max time kernel
133s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 02:48

Target

c67859c31490779164c623e9ea601f4b5a4703905356662baca0b229aded5e41.dll
Size

152KB
MD5

fd4e4bdb1d3305da0607d40e97b1690a
SHA1

c3482b415cdb2d682cff087e1ff24b39dc5ece8d
SHA256

c67859c31490779164c623e9ea601f4b5a4703905356662baca0b229aded5e41
SHA512

73dff7a468712be0006ba453f28fbd114e2f4dadd6de31332049d2372342ff6827c521a73e6352a5100eb4d03f94c9c5f2a856a2be482595aacb7cfb595d8d0b
SSDEEP

3072:97+5EpeJE1P6YTrbUXruOKDhGOuyTTBftdwH2:97JNbbUXr+D7uyTTBldwH

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4984 2588 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4984	2588	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4940 wrote to memory of 2588	4940	rundll32.exe	rundll32.exe
PID 4940 wrote to memory of 2588	4940	rundll32.exe	rundll32.exe
PID 4940 wrote to memory of 2588	4940	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c67859c31490779164c623e9ea601f4b5a4703905356662baca0b229aded5e41.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4940

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c67859c31490779164c623e9ea601f4b5a4703905356662baca0b229aded5e41.dll,#1
2⤵
PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 564
3⤵
- Program crash
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2588 -ip 2588
1⤵
PID:368