d6e49de6d51d028050ad59df753e582008a4f1df92d4762f535a385eff0213b1

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 04:50

Target

d6e49de6d51d028050ad59df753e582008a4f1df92d4762f535a385eff0213b1.dll
Size

192KB
MD5

6623b9c1b109051921260eef40d70e50
SHA1

1cf09e68c06c1cf42b362bfe65df26a6ebab3b97
SHA256

d6e49de6d51d028050ad59df753e582008a4f1df92d4762f535a385eff0213b1
SHA512

d39063a08c1b857c8f07ae478c7e6654c025ab27bbfb0f825c6b978b3b2f4e7dff41e49bee64942c6db02dc75824794c64b55d05da6cc5222bbeb47f0bac5686
SSDEEP

3072:RIUHQRFF8Ebw3X/CJUc3f13TzGKnzHGlNzKG+aQVQvqNHxa9MrC:DHQRLbykRN3PzWmUc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3928	2944	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 2944	4804	rundll32.exe	82
PID 4804 wrote to memory of 2944	4804	rundll32.exe	82
PID 4804 wrote to memory of 2944	4804	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6e49de6d51d028050ad59df753e582008a4f1df92d4762f535a385eff0213b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6e49de6d51d028050ad59df753e582008a4f1df92d4762f535a385eff0213b1.dll,#1
  2⤵
  PID:2944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 624
    3⤵
    - Program crash
    PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2944 -ip 2944
1⤵
PID:224