1c83f6400322233a1b04ba2ac7c5cd1b0b2c694425dcef6a67337071a885ff41

Analysis

max time kernel
93s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 14:24

Target

1c83f6400322233a1b04ba2ac7c5cd1b0b2c694425dcef6a67337071a885ff41.dll
Size

218KB
MD5

12f569ef433933aa962930face9d86d5
SHA1

121a28c2b987756916acb5b2ff3bcf1f678e9156
SHA256

1c83f6400322233a1b04ba2ac7c5cd1b0b2c694425dcef6a67337071a885ff41
SHA512

4e4cff47d92cdb7a17eb77dedad7a664fba125866a723ba7739161d093565e3ad2a32221e7ee0fea838cbb03bb868c5e9694c613583a5c7018c8b8554a7aaf52
SSDEEP

3072:4fyTFpiSc43UtiD8Umh8I6lk0bF+EjJeNDU2a7i78nifiRjdUh5zoBS:4flD4ktiD8UI8I66C+6AsXnifujR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
60	4032	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 4032	2484	rundll32.exe	81
PID 2484 wrote to memory of 4032	2484	rundll32.exe	81
PID 2484 wrote to memory of 4032	2484	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c83f6400322233a1b04ba2ac7c5cd1b0b2c694425dcef6a67337071a885ff41.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c83f6400322233a1b04ba2ac7c5cd1b0b2c694425dcef6a67337071a885ff41.dll,#1
  2⤵
  PID:4032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 632
    3⤵
    - Program crash
    PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4032 -ip 4032
1⤵
PID:1960