aa3732cf0c08c287db49dae9cd11ac456d2a01db9de25e8e0e4f9c86196db4d8

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 11:37

Target

aa3732cf0c08c287db49dae9cd11ac456d2a01db9de25e8e0e4f9c86196db4d8.dll
Size

2.1MB
MD5

332b66bf4c83f8d24703bf42820d914d
SHA1

e830922fe67ce60a2f4d8bca7386ece86108acf3
SHA256

aa3732cf0c08c287db49dae9cd11ac456d2a01db9de25e8e0e4f9c86196db4d8
SHA512

20de03d55bf95fafbe8e7018f903fceeeba60ea7983db367138fbe3a5abf45fad8bcb897f92093307c8447a1f6fa67a88aad5a56aef683a0bc5b3c415faf44dd
SSDEEP

49152:y8feI79oK2xUrHv31P0bhJ/P0BDpinATs75a78tL:y8D7WK2U/tLBDpgh08tL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4492	1804	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 1804	4060	rundll32.exe	81
PID 4060 wrote to memory of 1804	4060	rundll32.exe	81
PID 4060 wrote to memory of 1804	4060	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa3732cf0c08c287db49dae9cd11ac456d2a01db9de25e8e0e4f9c86196db4d8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa3732cf0c08c287db49dae9cd11ac456d2a01db9de25e8e0e4f9c86196db4d8.dll,#1
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 560
    3⤵
    - Program crash
    PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1804 -ip 1804
1⤵
PID:4396