5791d47b59c01cc5a9200cbaf2944b1f49401967862e3f57c50522e3e8e01c01

Analysis

max time kernel
93s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 00:22

Target

5791d47b59c01cc5a9200cbaf2944b1f49401967862e3f57c50522e3e8e01c01.dll
Size

205KB
MD5

4995bc5dc16a41f4116ae8087a76f8ee
SHA1

e01dde1d19328909ce6d3aca4372697f6eca59ec
SHA256

5791d47b59c01cc5a9200cbaf2944b1f49401967862e3f57c50522e3e8e01c01
SHA512

51fca1a612585581720cc01a8d7d64ec4e095759b75a01c3c098716da2396eaadc3f7f0922b148c9bc457afd47ae5021eb380589468e559a9b8ea6c749df1d08
SSDEEP

3072:0/QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUi5Qp:0/MEfuN0t8C5oFsoeRM3o0j0

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1192 1452 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1192	1452	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1496 wrote to memory of 1452	1496	rundll32.exe	rundll32.exe
PID 1496 wrote to memory of 1452	1496	rundll32.exe	rundll32.exe
PID 1496 wrote to memory of 1452	1496	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5791d47b59c01cc5a9200cbaf2944b1f49401967862e3f57c50522e3e8e01c01.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5791d47b59c01cc5a9200cbaf2944b1f49401967862e3f57c50522e3e8e01c01.dll,#1
2⤵
PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 632
3⤵
- Program crash
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1452 -ip 1452
1⤵
PID:3776