e3d7fcc36cda432999226b29d6e9d3ec49ad55702b81c0a4b0e6a0cc4997a44b

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 17:43

Target
e7436257a8459ae2e5658b47bc8ecce94ce915e9091647f3644d35c8c7118cd2.dll
Size 204KB
Sample240722-walh7syglc
SHA256 e7436257a8459ae2e5658b47bc8ecce94ce915e9091647f3644d35c8c7118cd2
MD5 5de1685cf392d2e08f8ba14d90dbf26b
SHA1 e697307a8a053ded6cde28d7a63e812dd13c26b4
SHA512 032f363f9b5a3ecd43637b486ff6d5bad06ff503d9d611fb180a6beb8e3647af4b05d688517faaa60136307842ae80d0db5e2bf514abee83d847a27b9cf34cd4
SSDEEP 3072:5dFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQUFC5g:FRYkcrY4MCIt07iPlvU0j
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4136	4208	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 4208	4064	rundll32.exe	84
PID 4064 wrote to memory of 4208	4064	rundll32.exe	84
PID 4064 wrote to memory of 4208	4064	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7436257a8459ae2e5658b47bc8ecce94ce915e9091647f3644d35c8c7118cd2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7436257a8459ae2e5658b47bc8ecce94ce915e9091647f3644d35c8c7118cd2.dll,#1
  2⤵
  PID:4208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 632
    3⤵
    - Program crash
    PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4208 -ip 4208
1⤵
PID:3836