1d59e045d47521bb4b3efbf731636611774b5de594b3094fc579d172000591f9

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 07:49

Target

1d59e045d47521bb4b3efbf731636611774b5de594b3094fc579d172000591f9.dll
Size

2.0MB
MD5

b42b3c1bd526e9a34f45828491cfe4b6
SHA1

f48860ba2ee5c2743c3e2f5a04220d826706d388
SHA256

1d59e045d47521bb4b3efbf731636611774b5de594b3094fc579d172000591f9
SHA512

6dc20bafda1da246cae3393a2de7979f9389fa4ad1705d6f7b0a9f4994df7160b49b3c5dbf65d1b387b629b6954d65936f5bd15053bc9fe16a74efb04b13881b
SSDEEP

49152:SpW2WCN9mIFOKjQ5TwaonUr1q7NWcPjHPhVbC5GMhE:SpW2WCDmIFOh5Tw4q7NWsvh

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1636	4780	WerFault.exe	83
3384	4780	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4780	1936	rundll32.exe	83
PID 1936 wrote to memory of 4780	1936	rundll32.exe	83
PID 1936 wrote to memory of 4780	1936	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d59e045d47521bb4b3efbf731636611774b5de594b3094fc579d172000591f9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d59e045d47521bb4b3efbf731636611774b5de594b3094fc579d172000591f9.dll,#1
  2⤵
  PID:4780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 620
    3⤵
    - Program crash
    PID:1636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 792
    3⤵
    - Program crash
    PID:3384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4780 -ip 4780
1⤵
PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4780 -ip 4780
1⤵
PID:4944