07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2

Analysis

max time kernel
93s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 18:38

Target

07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2.dll
Size

20KB
MD5

d1ce027186875abb6276c3c728ebc608
SHA1

a4ec7cf604b466079395c8a4b80bfcc7274f18a1
SHA256

07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2
SHA512

418458c102cf3be56c0fb46c2899b52c60922974bccec8d22113ebde3b747ab143e20d4a9dc494184f623803009f7c6f14f7e1907fea14a0de65928d9796d9f5
SSDEEP

96:X908s82LTQTLnOU19Fi6kITearYEoosuvV/O:t08n2fQ/P1QIqajoosk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1676	2060	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 2060	3576	rundll32.exe	82
PID 3576 wrote to memory of 2060	3576	rundll32.exe	82
PID 3576 wrote to memory of 2060	3576	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\07b64ee946cf08326b05a380fedeec94f6da8c2f557040447134b30b1dbcfff2.dll,#1
  2⤵
  PID:2060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 600
    3⤵
    - Program crash
    PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2060 -ip 2060
1⤵
PID:5080