c0a5ac074dc0c1669ba247e43789ee3bfddb2d583e9e342ac4fdd6ff3a93562f

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 02:19

Target

c0a5ac074dc0c1669ba247e43789ee3bfddb2d583e9e342ac4fdd6ff3a93562f.dll
Size

266KB
MD5

a3a1f9b32ef7aae19ac1419d1f4d6107
SHA1

a5a296672f8608d26fc03d37a94a315eae4f817a
SHA256

c0a5ac074dc0c1669ba247e43789ee3bfddb2d583e9e342ac4fdd6ff3a93562f
SHA512

bb96c6507dd374fc181a2c5ee8304904dd4c7289d3eecc4884019d764ef22cc3e74cbdd90ae3cb57a27788744518e1ba1d3d5f874f313c818f11220a439123d0
SSDEEP

6144:g/pb95LIbfMWZskFONizSLLsCn3cEFMWiFtNF7R5Lgr1A09:gBHEML25BkA09

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3780	2060	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2060	1772	rundll32.exe	81
PID 1772 wrote to memory of 2060	1772	rundll32.exe	81
PID 1772 wrote to memory of 2060	1772	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0a5ac074dc0c1669ba247e43789ee3bfddb2d583e9e342ac4fdd6ff3a93562f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0a5ac074dc0c1669ba247e43789ee3bfddb2d583e9e342ac4fdd6ff3a93562f.dll,#1
  2⤵
  PID:2060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 604
    3⤵
    - Program crash
    PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2060 -ip 2060
1⤵
PID:3776

memory/2060-0-0x0000000062000000-0x0000000062047000-memory.dmp

Filesize
284KB

Download
memory/2060-1-0x0000000062000000-0x0000000062047000-memory.dmp

Filesize
284KB

Download