75c0a6997a62ecd11450e32f03aff24a271c089804ef1a13441371feb77ffeb6

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 17:10

Target
bc5422b00487ebd23d494a3d84c301fecb8150a6c3cb54bbe8aace6aa732be81.dll
Size 208KB
Sample240715-vpq7katcld
SHA256 bc5422b00487ebd23d494a3d84c301fecb8150a6c3cb54bbe8aace6aa732be81
MD5 95b2404b2fb3401ccefca83be859f448
SHA1 e0ba8b21b94d1325f470ab7b6cc1bc282c0fab5f
SHA512 d0a6c29606637864cd66b163d97d473a82eadaa2123f95d05fa219feee8abb8f861fbd0531525d7f7290af66281b80ec6ddc99dbcd03062afa5bc7e6dbf17fcb
SSDEEP 3072:ZnT2RRXuwcN3OQXB8CITr9VV2ILe126JyTuBdjdUM5njAj:ZwXupN1x8CgBbRLDTuLjh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4128	3028	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 3028	4604	rundll32.exe	83
PID 4604 wrote to memory of 3028	4604	rundll32.exe	83
PID 4604 wrote to memory of 3028	4604	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc5422b00487ebd23d494a3d84c301fecb8150a6c3cb54bbe8aace6aa732be81.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc5422b00487ebd23d494a3d84c301fecb8150a6c3cb54bbe8aace6aa732be81.dll,#1
  2⤵
  PID:3028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 632
    3⤵
    - Program crash
    PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3028 -ip 3028
1⤵
PID:2760