1f99c0bd574a4f03ff854f42c401ea5a5ca79a15a1e0cdee754f4826d1c4300e

Analysis

max time kernel
51s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 19:29

Target

1f99c0bd574a4f03ff854f42c401ea5a5ca79a15a1e0cdee754f4826d1c4300e.dll
Size

113KB
MD5

c57132facae7af48d3d61c42c2a3d42a
SHA1

f0fd86dbde1fa807f040ee54eae7704ca69e8d7b
SHA256

1f99c0bd574a4f03ff854f42c401ea5a5ca79a15a1e0cdee754f4826d1c4300e
SHA512

61a05a468d4dcd937100b7f44b38db8a645563112df629ef128132058f8118e9e2b1b95815c1657fb97de18cfc55779908243ff8819286ffacf4c2e6245eaefd
SSDEEP

1536:YRA7XOXLXiywsc5KlymxgkVIgw9vW24eDkia2WdfsA8SWQUnQjtiBYBuq:nOX+swmzOlvyeq0A+S0YBuq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4172	1808	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 1808	4556	rundll32.exe	81
PID 4556 wrote to memory of 1808	4556	rundll32.exe	81
PID 4556 wrote to memory of 1808	4556	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f99c0bd574a4f03ff854f42c401ea5a5ca79a15a1e0cdee754f4826d1c4300e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f99c0bd574a4f03ff854f42c401ea5a5ca79a15a1e0cdee754f4826d1c4300e.dll,#1
  2⤵
  PID:1808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 600
    3⤵
    - Program crash
    PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1808 -ip 1808
1⤵
PID:4828