34a7e58ac55706f887d8af081d3d879242be6d4c772f27990e179c71a6f0c07e

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 10:27

Target

34a7e58ac55706f887d8af081d3d879242be6d4c772f27990e179c71a6f0c07e.dll
Size

208KB
MD5

0db7a878c1a97660de0e4874cc67aa41
SHA1

061e040f0babbfe67282ebefa8c434549c951051
SHA256

34a7e58ac55706f887d8af081d3d879242be6d4c772f27990e179c71a6f0c07e
SHA512

95adcb9859196364203fbda64fa4bc818bf4b667ded1adfb1c9938edc85e81445b12cfc8afa0f9360d9cb5d409842bb059ebd33e64a40a820bc974a9bb6fc7da
SSDEEP

3072:LI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUbY5M:LIDff9D8C6XYRw6MT2DEj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2456 1388 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2456	1388	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1548 wrote to memory of 1388	1548	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 1388	1548	rundll32.exe	rundll32.exe
PID 1548 wrote to memory of 1388	1548	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34a7e58ac55706f887d8af081d3d879242be6d4c772f27990e179c71a6f0c07e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\34a7e58ac55706f887d8af081d3d879242be6d4c772f27990e179c71a6f0c07e.dll,#1
2⤵
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 632
3⤵
- Program crash
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1388 -ip 1388
1⤵
PID:4160