f18ec61bcd6c328fcb7e3c288c7f8f1ba69f84c643d355d40372fba6cb8bc65b

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 05:24

Target

f18ec61bcd6c328fcb7e3c288c7f8f1ba69f84c643d355d40372fba6cb8bc65b.dll
Size

204KB
MD5

479d7c9aae86c3382aed04aac4fdd656
SHA1

32a40bccd7212e17ccd6d4dcc5ec0e0d9489b81a
SHA256

f18ec61bcd6c328fcb7e3c288c7f8f1ba69f84c643d355d40372fba6cb8bc65b
SHA512

9337ba7b1c45e5a81e00e9c5b7545b381e2e9bdf9df7014281c785c90fc18e6d5b41c5d12eb2f98f997a70b43f1ac1a259081bfd440c815cc6e0d428b7b2b600
SSDEEP

3072:YaMXwmjoFlRV/rrgx3whtXqZiBX2u8jZcwrFPOTBf/5PyHk02L2fG7:YfF8jrgxA/XWCwrFPOTB35Pak0xG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4576	4980	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4980	4604	rundll32.exe	83
PID 4604 wrote to memory of 4980	4604	rundll32.exe	83
PID 4604 wrote to memory of 4980	4604	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f18ec61bcd6c328fcb7e3c288c7f8f1ba69f84c643d355d40372fba6cb8bc65b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f18ec61bcd6c328fcb7e3c288c7f8f1ba69f84c643d355d40372fba6cb8bc65b.dll,#1
  2⤵
  PID:4980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 600
    3⤵
    - Program crash
    PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4980 -ip 4980
1⤵
PID:1160