cb6bb334e15093e624d5a39cac6e119515bc961ea5a1232ab4aa1f6930f21584

Analysis

max time kernel
134s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 19:18

Target

NamePipe.dll
Size

120KB
MD5

33cdf982159eade45da4b3d6c918135c
SHA1

33fee61ce7246084f1cf9c690cec108f2d140f70
SHA256

8b73c12d01551312e50f2130ff46cad309beedf09c10bb7ed0d0b9524b9aac7c
SHA512

92f0002ae2b2dbefae2cb40f3a8f3a069385fa9c41ca7889a6c37da2c1b761f0b09d9ccee3608cb55f59edbc38fdb820fb2e051710cf284662c0732dd353ab3d
SSDEEP

1536:t/0SnJ4AXldgfKjrgJwzRRs/w+W15mUcqMcYp1EbcC88sWjcdUB3lVmr3kF+f:tc6acIfAGCPsvU5mj1Ef8jUZlVmgwf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1448	5048	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 5048	4540	rundll32.exe	82
PID 4540 wrote to memory of 5048	4540	rundll32.exe	82
PID 4540 wrote to memory of 5048	4540	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NamePipe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NamePipe.dll,#1
  2⤵
  PID:5048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 612
    3⤵
    - Program crash
    PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5048 -ip 5048
1⤵
PID:4532