2489ea0972c77ac59ee9f62eae81edcee3f289e6ae11b1f160257c14da6dc0b0

Analysis

max time kernel
131s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 19:34

Target

2489ea0972c77ac59ee9f62eae81edcee3f289e6ae11b1f160257c14da6dc0b0.dll
Size

46KB
MD5

11b2b8e23834dab4f7b5e3b557966015
SHA1

c9d296f7bd18b6fba4339dc2c22a49e117b49954
SHA256

2489ea0972c77ac59ee9f62eae81edcee3f289e6ae11b1f160257c14da6dc0b0
SHA512

baf9956bcc17d387caeb60e5bbb9af68801806b5f5b107ec2b2f37c3722d6e9ec114a2c3007d2511b20232bec4b7f99854ccfa2d89fa5c05850f7c53d63e6ac4
SSDEEP

384:IOFu6OjomLJztPJcA8+qNIQhZtPnrRnJyn4:I5PUm9eBNIUX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	2376	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2376	2476	rundll32.exe	83
PID 2476 wrote to memory of 2376	2476	rundll32.exe	83
PID 2476 wrote to memory of 2376	2476	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2489ea0972c77ac59ee9f62eae81edcee3f289e6ae11b1f160257c14da6dc0b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2489ea0972c77ac59ee9f62eae81edcee3f289e6ae11b1f160257c14da6dc0b0.dll,#1
  2⤵
  PID:2376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 600
    3⤵
    - Program crash
    PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2376 -ip 2376
1⤵
PID:4744

memory/2376-0-0x0000000061F00000-0x0000000061F0A000-memory.dmp

Filesize
40KB

Download