260bd64aff76afa4a037ea5b97499e8e5f7819ce34509360f0cbb78b42f5292e

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-06-2024 04:06

Target

http_dll.dll
Size

127KB
MD5

5c28d36c6cc39b20c882cfdc1235a684
SHA1

d4d829cdb28b081ed72547b8fc63bfc9aaf22f06
SHA256

260bd64aff76afa4a037ea5b97499e8e5f7819ce34509360f0cbb78b42f5292e
SHA512

1dfd293b47b46082890dfee015f3284f02032c942f1b51afcdd58031a7d2e80db87a7d13eda85c1ebc1acea5580b669c1d7d8b7b61c75778e663cb48b9671275
SSDEEP

1536:h+sRWd4nhueU5u2s1N/47TVWeBeu644kPOLD38lKHPEryZ21uZjYCBA3MpM7c8uB:5sURE3VW8POLwlKb21uRYCuLMF6eok

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1616	4968	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4968	4652	rundll32.exe	82
PID 4652 wrote to memory of 4968	4652	rundll32.exe	82
PID 4652 wrote to memory of 4968	4652	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\http_dll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\http_dll.dll,#1
  2⤵
  PID:4968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 600
    3⤵
    - Program crash
    PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4968 -ip 4968
1⤵
PID:656