57f5e297b6514088a876f196167e9693b5a4f38cdac795be3db4b9ad7cb713c8

Analysis

max time kernel
102s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 13:24

Target

b72cc96bb74c3153dd6201a6df10d8b0N.dll
Size

124KB
MD5

b72cc96bb74c3153dd6201a6df10d8b0
SHA1

1327b3b0a4eaabfd9285e1ed39b0d9431eb3059a
SHA256

57f5e297b6514088a876f196167e9693b5a4f38cdac795be3db4b9ad7cb713c8
SHA512

e823212f6cb2c7c62add27fc9dd064e59eeb8106552cbd4be96db147037cf8799eba56f13600e932f8db628c911373b2761ecde5507f583ddfa6f942e966acd6
SSDEEP

3072:G5CZZu/h6AABVDPHjvk10tReQ+DTEUvvrXkJVgbugxj:G5yo/XAbPHTkfEUHrXkJVgbuS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3664	376	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 376	1544	rundll32.exe	84
PID 1544 wrote to memory of 376	1544	rundll32.exe	84
PID 1544 wrote to memory of 376	1544	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b72cc96bb74c3153dd6201a6df10d8b0N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b72cc96bb74c3153dd6201a6df10d8b0N.dll,#1
  2⤵
  PID:376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 644
    3⤵
    - Program crash
    PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 376 -ip 376
1⤵
PID:4780