a05889eddcb2ad7e9912fa536187594f3fc0c4efa658697c18c7de0ef7ef888d

Analysis

max time kernel
51s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 00:27

Target

a05889eddcb2ad7e9912fa536187594f3fc0c4efa658697c18c7de0ef7ef888d.dll
Size

65KB
MD5

bd15c6be50761af6c241c0ddba300f78
SHA1

edcbbdc2e8d08e70ae4da6946e75b1db14fdfd47
SHA256

a05889eddcb2ad7e9912fa536187594f3fc0c4efa658697c18c7de0ef7ef888d
SHA512

5635e4f9059d30904acc109964fbd7d58cf3db088118c478bbd73d309b7cdb66c6f427a99d37b3df9bab0d0ba2c06bb339c700328e79680e4506bdef00ba5987
SSDEEP

1536:70ZkQJH3OezE1SzdR4CyRePHlIb0w6CJsu968vYA100yUIss:76dJ+YWk00EslmpyUO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1808	4000	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 4000	4352	rundll32.exe	81
PID 4352 wrote to memory of 4000	4352	rundll32.exe	81
PID 4352 wrote to memory of 4000	4352	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a05889eddcb2ad7e9912fa536187594f3fc0c4efa658697c18c7de0ef7ef888d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a05889eddcb2ad7e9912fa536187594f3fc0c4efa658697c18c7de0ef7ef888d.dll,#1
  2⤵
  PID:4000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 612
    3⤵
    - Program crash
    PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4000 -ip 4000
1⤵
PID:2160

memory/4000-0-0x0000000001FE0000-0x0000000001FF3000-memory.dmp

Filesize
76KB

Download
memory/4000-1-0x0000000001FE0000-0x0000000001FF3000-memory.dmp

Filesize
76KB

Download