03fc624cb5d14baa080f73a24b427f0546ce3fb4259f19166e7ffd12c348bbfe

Analysis

max time kernel
91s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 18:14

Target
03fc624cb5d14baa080f73a24b427f0546ce3fb4259f19166e7ffd12c348bbfe.dll
Size 275KB
Sample240603-wvhcaaff78
SHA256 03fc624cb5d14baa080f73a24b427f0546ce3fb4259f19166e7ffd12c348bbfe
MD5 d058a03f0d7c4acf27a9b55d39f5e061
SHA1 ba38bb04928418c5b2670bf4eb51c7f013c99555
SHA512 9410abe5c8a82a6919dd4daae57a87753a093bca9c3ea17f6bf20288747f355bee99170a7c779950ae025862e647a07a7189a2cf66c5d06fdfea592cdd322a6c
SSDEEP 6144:1Mqrg5+w9OvIwhwvkOkz4/GZ+GAgiKh9:+qr5Evzw4/GZlAMh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2724	2816	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2816	2780	rundll32.exe	82
PID 2780 wrote to memory of 2816	2780	rundll32.exe	82
PID 2780 wrote to memory of 2816	2780	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03fc624cb5d14baa080f73a24b427f0546ce3fb4259f19166e7ffd12c348bbfe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\03fc624cb5d14baa080f73a24b427f0546ce3fb4259f19166e7ffd12c348bbfe.dll,#1
  2⤵
  PID:2816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 672
    3⤵
    - Program crash
    PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2816 -ip 2816
1⤵
PID:3660