c60c6646c885c478dc1cb676e13ef188ecadd542cb310015ed3eab41e5874f8f

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 06:07

Target
c60c6646c885c478dc1cb676e13ef188ecadd542cb310015ed3eab41e5874f8f.dll
Size 949KB
Sample240529-gvs2fscg7y
SHA256 c60c6646c885c478dc1cb676e13ef188ecadd542cb310015ed3eab41e5874f8f
MD5 415f4e5f26ebe98c2005067700ac8058
SHA1 946df2a963d26b7aaec666851017957cf410483a
SHA512 5d73b887e6656eb38943cd5672b1dbd6a205c1a5fc6617493ca098c4ca785451261f3824247375c41cb6bdeefa0d7a4de0aff9868c222e5cf38dba73d5f5b9d9
SSDEEP 24576:/UrlDUTEEp0nDkkl5lEzl7jCocrbZjQFnrEH72:MrlDUTKDkkPqZfCbbZjQFb
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
400	4528	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 4528	1864	rundll32.exe	81
PID 1864 wrote to memory of 4528	1864	rundll32.exe	81
PID 1864 wrote to memory of 4528	1864	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c60c6646c885c478dc1cb676e13ef188ecadd542cb310015ed3eab41e5874f8f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c60c6646c885c478dc1cb676e13ef188ecadd542cb310015ed3eab41e5874f8f.dll,#1
  2⤵
  PID:4528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 560
    3⤵
    - Program crash
    PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4528 -ip 4528
1⤵
PID:1056