ca0aa64709305034848e66957ccca8ccbf4eb37fb70ef444dfad93046e4e8e95

Analysis

max time kernel
480s
max time network
627s
platform
windows10-2004_x64
resource
win10v2004-20220812-es
resource tags

arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
05/09/2022, 23:22

Target
Binary.plesysy2.dll
Size 261.6MB
Sample220905-3czbeagfep
SHA256 ca0aa64709305034848e66957ccca8ccbf4eb37fb70ef444dfad93046e4e8e95
MD5 3e17244e728457cbc9966db4dabb54a7
SHA1 8ed6dea320897e4e0a50fa00908e8150c05c32fa
SHA512 f1c296bba8ed65343f4b2964273f72614958ba3d95bf502b924ca31328cec57fde3d63d9833dc34371ff9b188a1e764ff6e65ba8a120b9ea9c3085690029d77d
SSDEEP 98304:sS/youOxUITSN5B7IdVpR8gPUhL3LChQqZ6:sAxUmSvB7FgPqL3I
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4924	996	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 996	4692	rundll32.exe	82
PID 4692 wrote to memory of 996	4692	rundll32.exe	82
PID 4692 wrote to memory of 996	4692	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Binary.plesysy2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Binary.plesysy2.dll,#1
  2⤵
  PID:996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 676
    3⤵
    - Program crash
    PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 996 -ip 996
1⤵
PID:4904

memory/996-133-0x00000000020D0000-0x00000000030D0000-memory.dmp

Download