713689ce684698bd56317dafcb13d1a53e542a6cc52de5c50aba39d8a6122578

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 20:42

Target

713689ce684698bd56317dafcb13d1a53e542a6cc52de5c50aba39d8a6122578.dll
Size

2.5MB
MD5

d3c6c311d473f35e835a2fdf167fbb9f
SHA1

50b5222722d20c5f5b5e1427b0142009174485ad
SHA256

713689ce684698bd56317dafcb13d1a53e542a6cc52de5c50aba39d8a6122578
SHA512

8950bda210c627d9d7f4e0dacf378bb79bda5ade5f06af32706647b0abe026db97e8d73a4cdd128d806f427e04372aeba70564ccaa12b6be43309de434870f14
SSDEEP

49152:lHAqgj9y6j2RB3zVBgnif0tflS5D/CuE2vLmDa5Ri:eh99jyD4ifKNS5212vmG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3076	4488	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4488	4108	rundll32.exe	84
PID 4108 wrote to memory of 4488	4108	rundll32.exe	84
PID 4108 wrote to memory of 4488	4108	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\713689ce684698bd56317dafcb13d1a53e542a6cc52de5c50aba39d8a6122578.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\713689ce684698bd56317dafcb13d1a53e542a6cc52de5c50aba39d8a6122578.dll,#1
  2⤵
  PID:4488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 552
    3⤵
    - Program crash
    PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4488 -ip 4488
1⤵
PID:3020

memory/4488-0-0x0000000002450000-0x00000000026C7000-memory.dmp

Filesize
2.5MB

Download