bdb873b504db79a1c821f1c4019fc53ab5e2e55bbb629f45782ed65e1956236e

Analysis

max time kernel
132s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 15:05

Target

c0f6499baf827a76b6b7a58ed92ceb45916b85180d4f858ef52f4b5ecda237b3.dll
Size

213KB
MD5

3d6e8ff8131c7bd4e50e6fc793b04358
SHA1

aad7146ff114910acb5b787045cee8c68e0e2e99
SHA256

c0f6499baf827a76b6b7a58ed92ceb45916b85180d4f858ef52f4b5ecda237b3
SHA512

cd51bb6faf961fb887a9ff72fbf7d2b12075a905384b31f02a7ac9077879f63f558d3782ce957f37492b0130c425d181037e2cb399db1ca42d01b9b80212d7d2
SSDEEP

3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15adTWlXm:PjdFKdoSxvixTxUAoWJm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1032	1008	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 1008	4272	rundll32.exe	83
PID 4272 wrote to memory of 1008	4272	rundll32.exe	83
PID 4272 wrote to memory of 1008	4272	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0f6499baf827a76b6b7a58ed92ceb45916b85180d4f858ef52f4b5ecda237b3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0f6499baf827a76b6b7a58ed92ceb45916b85180d4f858ef52f4b5ecda237b3.dll,#1
  2⤵
  PID:1008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 680
    3⤵
    - Program crash
    PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1008 -ip 1008
1⤵
PID:3892