0686f40ecb7127fb07d082f93bd64bfa97ed97fa2690e1925ad5d86dbbfee2d6

Analysis

max time kernel
93s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 18:22

Target

0686f40ecb7127fb07d082f93bd64bfa97ed97fa2690e1925ad5d86dbbfee2d6.dll
Size

1.1MB
MD5

f6ee58b6489e5fe7de4d5b25f56ce082
SHA1

5cc9d089c1c62adf7d6e2fcc54122b424cc4d924
SHA256

0686f40ecb7127fb07d082f93bd64bfa97ed97fa2690e1925ad5d86dbbfee2d6
SHA512

b14a0a31f042e132d7ab2e5af8936373312b266145b414d96224902a6bb3a36778c35f16cdf262250ee95b5efcf40426b41c34dbfdeaf331a6b5b9e5e12a46eb
SSDEEP

6144:gPY3rESx3yF9xfPEDxwV6GgJGuHZLH5L:c+rESx3mxfPEDxwV6GbEFH5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4200	2524	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 2524	1596	rundll32.exe	82
PID 1596 wrote to memory of 2524	1596	rundll32.exe	82
PID 1596 wrote to memory of 2524	1596	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0686f40ecb7127fb07d082f93bd64bfa97ed97fa2690e1925ad5d86dbbfee2d6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0686f40ecb7127fb07d082f93bd64bfa97ed97fa2690e1925ad5d86dbbfee2d6.dll,#1
  2⤵
  PID:2524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 544
    3⤵
    - Program crash
    PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2524 -ip 2524
1⤵
PID:3848