ad4093217d4b838217ccf0021c450a55b2be6ce8bfdafad645fec53cbade0abf

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 01:18

Target

2c7bdfde028ae9822d205bd361fa82cd97fdb89fb6fe528af3ed725f31c52ffd.dll
Size

248KB
MD5

178e90e3fc42c575e6cb505f1a40575c
SHA1

8d54af5e9c603fee94db315d198ef38f529b144c
SHA256

2c7bdfde028ae9822d205bd361fa82cd97fdb89fb6fe528af3ed725f31c52ffd
SHA512

f89deca1a2d77c4e9864c8e56ec02152fa079d17c4d9c29a1a37aa184c479283c33d5a3799fadda0fa2b857710f0a0ada18a6c8dc9f365e5de47b3754e75b45d
SSDEEP

3072:cnT2RRXuwcN3OQXB8CITr9VV2ILe126JyTu+djdUC5UEj:cwXupN1x8CgBbRLDTuOj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3296	4156	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 4156	1868	rundll32.exe	83
PID 1868 wrote to memory of 4156	1868	rundll32.exe	83
PID 1868 wrote to memory of 4156	1868	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c7bdfde028ae9822d205bd361fa82cd97fdb89fb6fe528af3ed725f31c52ffd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c7bdfde028ae9822d205bd361fa82cd97fdb89fb6fe528af3ed725f31c52ffd.dll,#1
  2⤵
  PID:4156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 588
    3⤵
    - Program crash
    PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4156 -ip 4156
1⤵
PID:2328