b6d32ae916a2cfd4220c5613f3a8210cfe3c8b1ed3b66a38588891a1d1bf7aab

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 07:26

Target

b6d32ae916a2cfd4220c5613f3a8210cfe3c8b1ed3b66a38588891a1d1bf7aab.dll
Size

306KB
MD5

fbe5f9f39094e1453dcd1101dc897020
SHA1

8cc91bbb6bb8902bf29d1e4a907e482c5d2e3d48
SHA256

b6d32ae916a2cfd4220c5613f3a8210cfe3c8b1ed3b66a38588891a1d1bf7aab
SHA512

38e8931359001e616beef62e63bf77994f9722e85ed1f3b1d23e3778b5d8056c1fbba64539154352a761629ed68a4b201102d610c565282bad6c1347f1f2314e
SSDEEP

6144:Yu1O8/R/35k0UmtbxeAe26fNPNxAow/CzfB7+ZnAdjAAQnZF3Uvu:Yu13/R/3OWt36fNNqf+QZAdjAfZxUvu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5116	3892	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3892	4984	rundll32.exe	82
PID 4984 wrote to memory of 3892	4984	rundll32.exe	82
PID 4984 wrote to memory of 3892	4984	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6d32ae916a2cfd4220c5613f3a8210cfe3c8b1ed3b66a38588891a1d1bf7aab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6d32ae916a2cfd4220c5613f3a8210cfe3c8b1ed3b66a38588891a1d1bf7aab.dll,#1
  2⤵
  PID:3892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 560
    3⤵
    - Program crash
    PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3892 -ip 3892
1⤵
PID:228