dc8f61a3c9960b4da2bcbb0840f3cfcd1b4398d018403373edb420b158df5193

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 14:18

Target

1948-3-0x0000000000240000-0x0000000000248000-memory.dll
Size

32KB
MD5

4299e12b1981178d6d6e61b4b76a110c
SHA1

108f0fcb57260771b399ae045fcc98a82c8d67df
SHA256

dc8f61a3c9960b4da2bcbb0840f3cfcd1b4398d018403373edb420b158df5193
SHA512

35e5374dea4b366181715b8f6df3a3e2f041ec82830587dd08e7a79963607932036c2a2885a5c18afee6a183738908d5fcfbb3420d7517135753861b6ab9bea8
SSDEEP

384:XajSEIxxP5OZAlAPosPkUfvKMp5yEZ0SjYq:Xajod5O+YkUXNrjP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3868	3208	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 3208	736	rundll32.exe	82
PID 736 wrote to memory of 3208	736	rundll32.exe	82
PID 736 wrote to memory of 3208	736	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1948-3-0x0000000000240000-0x0000000000248000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1948-3-0x0000000000240000-0x0000000000248000-memory.dll,#1
  2⤵
  PID:3208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 560
    3⤵
    - Program crash
    PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3208 -ip 3208
1⤵
PID:2420