07655f8a8dd00bf74b0bd069bd875fce38be8ad0516993530d791927ef40b2e7

Analysis

max time kernel
137s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 18:24

Target
07655f8a8dd00bf74b0bd069bd875fce38be8ad0516993530d791927ef40b2e7.dll
Size 24KB
Sample240603-w2fr2aef2t
SHA256 07655f8a8dd00bf74b0bd069bd875fce38be8ad0516993530d791927ef40b2e7
MD5 3e2e2adcedbfe9ffde8aa480cf6bbf32
SHA1 560b53c97f70644d90275c7fc25a41cf943db25a
SHA512 1f1e7c687561b95771e9bc0f9f66d371820ff9fc0bb1272027e478996a7e848bbbf726c8ee8de79843b3bcdb27ada81f3de07c7f9a5ad9fd13054a221ee41db4
SSDEEP 192:/cBrLuSWswO079mMJKgqBj6aEfz3DMNQ:/GMpDS6aEfz3DMN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1316	4636	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4636	4952	rundll32.exe	82
PID 4952 wrote to memory of 4636	4952	rundll32.exe	82
PID 4952 wrote to memory of 4636	4952	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07655f8a8dd00bf74b0bd069bd875fce38be8ad0516993530d791927ef40b2e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\07655f8a8dd00bf74b0bd069bd875fce38be8ad0516993530d791927ef40b2e7.dll,#1
  2⤵
  PID:4636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 604
    3⤵
    - Program crash
    PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4636 -ip 4636
1⤵
PID:3232