78c4c13373ee21eb47bd8fe104e2313ab85476ad381086070b84d5faaf44df02

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 00:22

Target
78c4c13373ee21eb47bd8fe104e2313ab85476ad381086070b84d5faaf44df02.dll
Size 1.1MB
Sample240614-an5ncaxdnf
SHA256 78c4c13373ee21eb47bd8fe104e2313ab85476ad381086070b84d5faaf44df02
MD5 f4e4a777d23ad3d8758bd694b0d4a2d0
SHA1 0826ced3d79f22cb55a495acffdc374f69ea2412
SHA512 97d1476aa85f82738707a9ca4dc4118ce7938236ba9ac218ea10b3e5a85ee8c39a099fca02b825aa1c6618c8e6b8d44f300722cacd7c56529a2074bd1cda6f7f
SSDEEP 24576:7DmEjCMA8bYmi+PxUhsFuXbIYHEzQDTK10T4WwhVR+Wb9xb:7tQ8bYmBPxHobIYkzQvKu5wheWb9xb
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1528	2240	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 2240	4180	rundll32.exe	82
PID 4180 wrote to memory of 2240	4180	rundll32.exe	82
PID 4180 wrote to memory of 2240	4180	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78c4c13373ee21eb47bd8fe104e2313ab85476ad381086070b84d5faaf44df02.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78c4c13373ee21eb47bd8fe104e2313ab85476ad381086070b84d5faaf44df02.dll,#1
  2⤵
  PID:2240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 560
    3⤵
    - Program crash
    PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2240 -ip 2240
1⤵
PID:3508