1c6a7b53591f44d24a2f70dab5d8357451bb35befe827f4b52052dff4949d7af

Analysis

max time kernel
102s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 23:05

Target

2692f74ef9add47bb902934c8f108530N.dll
Size

68KB
MD5

2692f74ef9add47bb902934c8f108530
SHA1

b2a462a8e3063e4ad18316c75fe6cbb9f8a69732
SHA256

1c6a7b53591f44d24a2f70dab5d8357451bb35befe827f4b52052dff4949d7af
SHA512

dafc00d12bca1a2b4cf5706414633605c172459ae7328fd5175feadc6a163334fd26d73a5a92ec6bf35f4c60dd114413a73ef994ba7d597381e6b08bee8b9730
SSDEEP

1536:1n8N/hO1Yq/TRBx/fj7h+jgaSSbFzI/WGMBn++U7nbxvU:SRhO2iTR3fjZZSIWGMBn++U7bxs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1080	2084	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2084	2992	rundll32.exe	84
PID 2992 wrote to memory of 2084	2992	rundll32.exe	84
PID 2992 wrote to memory of 2084	2992	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2692f74ef9add47bb902934c8f108530N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2692f74ef9add47bb902934c8f108530N.dll,#1
  2⤵
  PID:2084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 624
    3⤵
    - Program crash
    PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2084 -ip 2084
1⤵
PID:3648