77d6610a1b6d2691f92140b83dcd56286ec2a303e11dc65bcd8f805990a69f02

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 17:22

Target

77d6610a1b6d2691f92140b83dcd56286ec2a303e11dc65bcd8f805990a69f02.dll
Size

242KB
MD5

277728db726a4b2f2c1a24d0a9845ae8
SHA1

4675a34e7e1a7d75d9f44588bb036816025cfc22
SHA256

77d6610a1b6d2691f92140b83dcd56286ec2a303e11dc65bcd8f805990a69f02
SHA512

ac1efa1342f1d130b39067110224c3d4534cf7be574c4f2df5bd4a466aeb6ba2d09f1072bf0d51fc306646052424f313afc4c9233f16c84703fd2c0ed95c12a9
SSDEEP

3072:1mkH4V2aLdAJJ5WcZW4TH25KXs8o66yWpQJU6fUzpqtcWGQT0Jkegj9UVY5494b/:Ykvae5Wck4CAal6U6MzJk7jg6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

856 3372 WerFault.exe rundll32.exe

pid	pid_target	process	target process
856	3372	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4620 wrote to memory of 3372	4620	rundll32.exe	rundll32.exe
PID 4620 wrote to memory of 3372	4620	rundll32.exe	rundll32.exe
PID 4620 wrote to memory of 3372	4620	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77d6610a1b6d2691f92140b83dcd56286ec2a303e11dc65bcd8f805990a69f02.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4620

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\77d6610a1b6d2691f92140b83dcd56286ec2a303e11dc65bcd8f805990a69f02.dll,#1
2⤵
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 632
3⤵
- Program crash
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3372 -ip 3372
1⤵
PID:3168